From 20caa5fbf7108a38f1150d170b976e6234a4fc55 Mon Sep 17 00:00:00 2001 From: Sebastian Fuchs Date: Mon, 19 Oct 2026 09:04:59 +0200 Subject: [PATCH] refactor: Rename `responseHeaderReport` to `responseHeadersReport` --- .changeset/rename-response-headers-report.md | 5 +++ ...ecommends_all_headers_for_empty_headers.md | 2 +- .../recommends_changing_deviating_values.md | 2 +- ...ecommends_nothing_for_compliant_headers.md | 2 +- ...recommends_removing_discouraged_headers.md | 2 +- ...der_values_ignoring_case_and_whitespace.md | 2 +- .../document/accepts_stricter_values.md | 2 +- ..._unrelated_headers_and_masks_CSP_nonces.md | 2 +- ...ecommends_all_headers_for_empty_headers.md | 2 +- .../recommends_changing_deviating_values.md | 2 +- ...ecommends_nothing_for_compliant_headers.md | 2 +- ...recommends_removing_discouraged_headers.md | 2 +- docs/.vitepress/config.ts | 4 +-- ...r-report.md => response-headers-report.md} | 12 +++---- src/index.ts | 6 ++-- ...r-report.ts => response-headers-report.ts} | 10 +++--- ...pec.ts => response-headers-report.spec.ts} | 32 +++++++++---------- 17 files changed, 48 insertions(+), 43 deletions(-) create mode 100644 .changeset/rename-response-headers-report.md rename data/test/validation/{response-header-report => response-headers-report}/api/recommends_all_headers_for_empty_headers.md (94%) rename data/test/validation/{response-header-report => response-headers-report}/api/recommends_changing_deviating_values.md (97%) rename data/test/validation/{response-header-report => response-headers-report}/api/recommends_nothing_for_compliant_headers.md (97%) rename data/test/validation/{response-header-report => response-headers-report}/api/recommends_removing_discouraged_headers.md (97%) rename data/test/validation/{response-header-report => response-headers-report}/compares_header_values_ignoring_case_and_whitespace.md (97%) rename data/test/validation/{response-header-report => response-headers-report}/document/accepts_stricter_values.md (97%) rename data/test/validation/{response-header-report => response-headers-report}/document/ignores_unrelated_headers_and_masks_CSP_nonces.md (98%) rename data/test/validation/{response-header-report => response-headers-report}/document/recommends_all_headers_for_empty_headers.md (96%) rename data/test/validation/{response-header-report => response-headers-report}/document/recommends_changing_deviating_values.md (98%) rename data/test/validation/{response-header-report => response-headers-report}/document/recommends_nothing_for_compliant_headers.md (97%) rename data/test/validation/{response-header-report => response-headers-report}/document/recommends_removing_discouraged_headers.md (98%) rename docs/src/security/{response-header-report.md => response-headers-report.md} (86%) rename src/security/{response-header-report.ts => response-headers-report.ts} (96%) rename tests/{response-header-report.spec.ts => response-headers-report.spec.ts} (86%) diff --git a/.changeset/rename-response-headers-report.md b/.changeset/rename-response-headers-report.md new file mode 100644 index 0000000..338f75b --- /dev/null +++ b/.changeset/rename-response-headers-report.md @@ -0,0 +1,5 @@ +--- +"@cronn/playwright-utils": patch +--- + +Rename `responseHeaderReport` to `responseHeadersReport` diff --git a/data/test/validation/response-header-report/api/recommends_all_headers_for_empty_headers.md b/data/test/validation/response-headers-report/api/recommends_all_headers_for_empty_headers.md similarity index 94% rename from data/test/validation/response-header-report/api/recommends_all_headers_for_empty_headers.md rename to data/test/validation/response-headers-report/api/recommends_all_headers_for_empty_headers.md index 224cd07..c5aa473 100644 --- a/data/test/validation/response-header-report/api/recommends_all_headers_for_empty_headers.md +++ b/data/test/validation/response-headers-report/api/recommends_all_headers_for_empty_headers.md @@ -1,4 +1,4 @@ -# Response Header Report +# Response Headers Report ## Detected Headers diff --git a/data/test/validation/response-header-report/api/recommends_changing_deviating_values.md b/data/test/validation/response-headers-report/api/recommends_changing_deviating_values.md similarity index 97% rename from data/test/validation/response-header-report/api/recommends_changing_deviating_values.md rename to data/test/validation/response-headers-report/api/recommends_changing_deviating_values.md index 91a2a0b..5177183 100644 --- a/data/test/validation/response-header-report/api/recommends_changing_deviating_values.md +++ b/data/test/validation/response-headers-report/api/recommends_changing_deviating_values.md @@ -1,4 +1,4 @@ -# Response Header Report +# Response Headers Report ## Detected Headers diff --git a/data/test/validation/response-header-report/api/recommends_nothing_for_compliant_headers.md b/data/test/validation/response-headers-report/api/recommends_nothing_for_compliant_headers.md similarity index 97% rename from data/test/validation/response-header-report/api/recommends_nothing_for_compliant_headers.md rename to data/test/validation/response-headers-report/api/recommends_nothing_for_compliant_headers.md index 2962897..bb3ac56 100644 --- a/data/test/validation/response-header-report/api/recommends_nothing_for_compliant_headers.md +++ b/data/test/validation/response-headers-report/api/recommends_nothing_for_compliant_headers.md @@ -1,4 +1,4 @@ -# Response Header Report +# Response Headers Report ## Detected Headers diff --git a/data/test/validation/response-header-report/api/recommends_removing_discouraged_headers.md b/data/test/validation/response-headers-report/api/recommends_removing_discouraged_headers.md similarity index 97% rename from data/test/validation/response-header-report/api/recommends_removing_discouraged_headers.md rename to data/test/validation/response-headers-report/api/recommends_removing_discouraged_headers.md index b36a61b..d768dae 100644 --- a/data/test/validation/response-header-report/api/recommends_removing_discouraged_headers.md +++ b/data/test/validation/response-headers-report/api/recommends_removing_discouraged_headers.md @@ -1,4 +1,4 @@ -# Response Header Report +# Response Headers Report ## Detected Headers diff --git a/data/test/validation/response-header-report/compares_header_values_ignoring_case_and_whitespace.md b/data/test/validation/response-headers-report/compares_header_values_ignoring_case_and_whitespace.md similarity index 97% rename from data/test/validation/response-header-report/compares_header_values_ignoring_case_and_whitespace.md rename to data/test/validation/response-headers-report/compares_header_values_ignoring_case_and_whitespace.md index 22a13fd..6356433 100644 --- a/data/test/validation/response-header-report/compares_header_values_ignoring_case_and_whitespace.md +++ b/data/test/validation/response-headers-report/compares_header_values_ignoring_case_and_whitespace.md @@ -1,4 +1,4 @@ -# Response Header Report +# Response Headers Report ## Detected Headers diff --git a/data/test/validation/response-header-report/document/accepts_stricter_values.md b/data/test/validation/response-headers-report/document/accepts_stricter_values.md similarity index 97% rename from data/test/validation/response-header-report/document/accepts_stricter_values.md rename to data/test/validation/response-headers-report/document/accepts_stricter_values.md index fed1ce7..4b3bcd5 100644 --- a/data/test/validation/response-header-report/document/accepts_stricter_values.md +++ b/data/test/validation/response-headers-report/document/accepts_stricter_values.md @@ -1,4 +1,4 @@ -# Response Header Report +# Response Headers Report ## Detected Headers diff --git a/data/test/validation/response-header-report/document/ignores_unrelated_headers_and_masks_CSP_nonces.md b/data/test/validation/response-headers-report/document/ignores_unrelated_headers_and_masks_CSP_nonces.md similarity index 98% rename from data/test/validation/response-header-report/document/ignores_unrelated_headers_and_masks_CSP_nonces.md rename to data/test/validation/response-headers-report/document/ignores_unrelated_headers_and_masks_CSP_nonces.md index 719aadd..91bd133 100644 --- a/data/test/validation/response-header-report/document/ignores_unrelated_headers_and_masks_CSP_nonces.md +++ b/data/test/validation/response-headers-report/document/ignores_unrelated_headers_and_masks_CSP_nonces.md @@ -1,4 +1,4 @@ -# Response Header Report +# Response Headers Report ## Detected Headers diff --git a/data/test/validation/response-header-report/document/recommends_all_headers_for_empty_headers.md b/data/test/validation/response-headers-report/document/recommends_all_headers_for_empty_headers.md similarity index 96% rename from data/test/validation/response-header-report/document/recommends_all_headers_for_empty_headers.md rename to data/test/validation/response-headers-report/document/recommends_all_headers_for_empty_headers.md index 350ddda..970f1fb 100644 --- a/data/test/validation/response-header-report/document/recommends_all_headers_for_empty_headers.md +++ b/data/test/validation/response-headers-report/document/recommends_all_headers_for_empty_headers.md @@ -1,4 +1,4 @@ -# Response Header Report +# Response Headers Report ## Detected Headers diff --git a/data/test/validation/response-header-report/document/recommends_changing_deviating_values.md b/data/test/validation/response-headers-report/document/recommends_changing_deviating_values.md similarity index 98% rename from data/test/validation/response-header-report/document/recommends_changing_deviating_values.md rename to data/test/validation/response-headers-report/document/recommends_changing_deviating_values.md index b271a48..cca74a2 100644 --- a/data/test/validation/response-header-report/document/recommends_changing_deviating_values.md +++ b/data/test/validation/response-headers-report/document/recommends_changing_deviating_values.md @@ -1,4 +1,4 @@ -# Response Header Report +# Response Headers Report ## Detected Headers diff --git a/data/test/validation/response-header-report/document/recommends_nothing_for_compliant_headers.md b/data/test/validation/response-headers-report/document/recommends_nothing_for_compliant_headers.md similarity index 97% rename from data/test/validation/response-header-report/document/recommends_nothing_for_compliant_headers.md rename to data/test/validation/response-headers-report/document/recommends_nothing_for_compliant_headers.md index c54013e..e903b51 100644 --- a/data/test/validation/response-header-report/document/recommends_nothing_for_compliant_headers.md +++ b/data/test/validation/response-headers-report/document/recommends_nothing_for_compliant_headers.md @@ -1,4 +1,4 @@ -# Response Header Report +# Response Headers Report ## Detected Headers diff --git a/data/test/validation/response-header-report/document/recommends_removing_discouraged_headers.md b/data/test/validation/response-headers-report/document/recommends_removing_discouraged_headers.md similarity index 98% rename from data/test/validation/response-header-report/document/recommends_removing_discouraged_headers.md rename to data/test/validation/response-headers-report/document/recommends_removing_discouraged_headers.md index d08a6f4..c3452f6 100644 --- a/data/test/validation/response-header-report/document/recommends_removing_discouraged_headers.md +++ b/data/test/validation/response-headers-report/document/recommends_removing_discouraged_headers.md @@ -1,4 +1,4 @@ -# Response Header Report +# Response Headers Report ## Detected Headers diff --git a/docs/.vitepress/config.ts b/docs/.vitepress/config.ts index e966677..2005add 100644 --- a/docs/.vitepress/config.ts +++ b/docs/.vitepress/config.ts @@ -68,8 +68,8 @@ export default defineConfig({ items: [ { text: "CSP Report", link: "/security/csp-report" }, { - text: "Response Header Report", - link: "/security/response-header-report", + text: "Response Headers Report", + link: "/security/response-headers-report", }, ], }, diff --git a/docs/src/security/response-header-report.md b/docs/src/security/response-headers-report.md similarity index 86% rename from docs/src/security/response-header-report.md rename to docs/src/security/response-headers-report.md index 233be57..fa51f30 100644 --- a/docs/src/security/response-header-report.md +++ b/docs/src/security/response-headers-report.md @@ -1,13 +1,13 @@ -# Response Header Report +# Response Headers Report -Security headers protect against common attacks like clickjacking, MIME sniffing or protocol downgrades, but a missing or weakened header usually goes unnoticed because the application keeps working. `responseHeaderReport` evaluates the headers of a response against a set of recommended security headers and returns a Markdown report, which can be stored as a file snapshot to detect any change to the headers. +Security headers protect against common attacks like clickjacking, MIME sniffing or protocol downgrades, but a missing or weakened header usually goes unnoticed because the application keeps working. `responseHeadersReport` evaluates the headers of a response against a set of recommended security headers and returns a Markdown report, which can be stored as a file snapshot to detect any change to the headers. ## Usage ```ts import { getResponseHeaders, - responseHeaderReport, + responseHeadersReport, } from "@cronn/playwright-utils"; import { expect, test } from "@playwright/test"; @@ -15,7 +15,7 @@ test("has secure response headers", async ({ page }) => { const response = await page.goto("/"); const headers = await getResponseHeaders(response); - expect(responseHeaderReport(headers, { type: "document" })).toMatchTextFile({ + expect(responseHeadersReport(headers, { type: "document" })).toMatchTextFile({ fileExtension: "md", }); }); @@ -24,7 +24,7 @@ test("has secure API response headers", async ({ request }) => { const response = await request.get("/api/users"); const headers = await getResponseHeaders(response); - expect(responseHeaderReport(headers, { type: "api" })).toMatchTextFile({ + expect(responseHeadersReport(headers, { type: "api" })).toMatchTextFile({ fileExtension: "md", }); }); @@ -35,7 +35,7 @@ test("has secure API response headers", async ({ request }) => { The report lists all evaluated headers of the response, followed by the recommendations: ```md -# Response Header Report +# Response Headers Report ## Detected Headers diff --git a/src/index.ts b/src/index.ts index febc374..29c7189 100644 --- a/src/index.ts +++ b/src/index.ts @@ -37,10 +37,10 @@ export { export { cspReport, getCspHeader } from "./security/csp-report"; export { getResponseHeaders, - responseHeaderReport, - type ResponseHeaderReportOptions, + responseHeadersReport, + type ResponseHeadersReportOptions, type ResponseHeaderType, -} from "./security/response-header-report"; +} from "./security/response-headers-report"; export { resolveFromPackageRoot } from "./file"; diff --git a/src/security/response-header-report.ts b/src/security/response-headers-report.ts similarity index 96% rename from src/security/response-header-report.ts rename to src/security/response-headers-report.ts index dca6a38..c9f22eb 100644 --- a/src/security/response-header-report.ts +++ b/src/security/response-headers-report.ts @@ -12,7 +12,7 @@ import { maskCspNonces } from "./csp-report"; export type ResponseHeaderType = "document" | "api"; -export interface ResponseHeaderReportOptions { +export interface ResponseHeadersReportOptions { type: ResponseHeaderType; } @@ -132,14 +132,14 @@ export async function getResponseHeaders( * const response = await page.goto("/"); * const headers = await getResponseHeaders(response); * - * expect(responseHeaderReport(headers, { type: "document" })).toMatchTextFile({ + * expect(responseHeadersReport(headers, { type: "document" })).toMatchTextFile({ * fileExtension: "md", * }); * ``` */ -export function responseHeaderReport( +export function responseHeadersReport( headers: Record, - options: ResponseHeaderReportOptions, + options: ResponseHeadersReportOptions, ): string { const recommendedHeaders = RECOMMENDED_HEADERS[options.type]; const discouragedHeaders = DISCOURAGED_HEADERS[options.type]; @@ -168,7 +168,7 @@ export function responseHeaderReport( (a, b) => ACTION_ORDER.indexOf(a.action) - ACTION_ORDER.indexOf(b.action), ); - return markdownDocument("Response Header Report", [ + return markdownDocument("Response Headers Report", [ { heading: "Detected Headers", content: markdownTableOrNone( diff --git a/tests/response-header-report.spec.ts b/tests/response-headers-report.spec.ts similarity index 86% rename from tests/response-header-report.spec.ts rename to tests/response-headers-report.spec.ts index 3722eac..faac55e 100644 --- a/tests/response-header-report.spec.ts +++ b/tests/response-headers-report.spec.ts @@ -4,12 +4,12 @@ import type { AddressInfo } from "node:net"; import { getResponseHeaders, - responseHeaderReport, + responseHeadersReport, type ResponseHeaderType, -} from "../src/security/response-header-report"; +} from "../src/security/response-headers-report"; import { expect } from "../src/test/fixtures"; -const SERVER_URL = "https://response-header-report.test"; +const SERVER_URL = "https://response-headers-report.test"; const COMPLIANT_API_HEADERS = { "cache-control": "no-store", @@ -33,15 +33,15 @@ const COMPLIANT_DOCUMENT_HEADERS = { test.describe("document", () => { test("recommends nothing for compliant headers", async () => { - await testResponseHeaderReport(COMPLIANT_DOCUMENT_HEADERS, "document"); + await testResponseHeadersReport(COMPLIANT_DOCUMENT_HEADERS, "document"); }); test("recommends all headers for empty headers", async () => { - await testResponseHeaderReport({}, "document"); + await testResponseHeadersReport({}, "document"); }); test("accepts stricter values", async () => { - await testResponseHeaderReport( + await testResponseHeadersReport( { ...COMPLIANT_DOCUMENT_HEADERS, "strict-transport-security": @@ -54,7 +54,7 @@ test.describe("document", () => { }); test("recommends changing deviating values", async () => { - await testResponseHeaderReport( + await testResponseHeadersReport( { ...COMPLIANT_DOCUMENT_HEADERS, "strict-transport-security": "max-age=3600", @@ -68,7 +68,7 @@ test.describe("document", () => { }); test("ignores unrelated headers and masks CSP nonces", async () => { - await testResponseHeaderReport( + await testResponseHeadersReport( { ...COMPLIANT_DOCUMENT_HEADERS, "content-security-policy": @@ -81,7 +81,7 @@ test.describe("document", () => { }); test("recommends removing discouraged headers", async () => { - await testResponseHeaderReport( + await testResponseHeadersReport( { ...COMPLIANT_DOCUMENT_HEADERS, "Access-Control-Allow-Origin": "*", @@ -94,15 +94,15 @@ test.describe("document", () => { test.describe("api", () => { test("recommends nothing for compliant headers", async () => { - await testResponseHeaderReport(COMPLIANT_API_HEADERS, "api"); + await testResponseHeadersReport(COMPLIANT_API_HEADERS, "api"); }); test("recommends all headers for empty headers", async () => { - await testResponseHeaderReport({}, "api"); + await testResponseHeadersReport({}, "api"); }); test("recommends changing deviating values", async () => { - await testResponseHeaderReport( + await testResponseHeadersReport( { ...COMPLIANT_API_HEADERS, "cross-origin-opener-policy": "unsafe-none", @@ -114,7 +114,7 @@ test.describe("api", () => { }); test("recommends removing discouraged headers", async () => { - await testResponseHeaderReport( + await testResponseHeadersReport( { ...COMPLIANT_API_HEADERS, "Access-Control-Allow-Origin": "*", @@ -126,7 +126,7 @@ test.describe("api", () => { }); test("compares header values ignoring case and whitespace", async () => { - await testResponseHeaderReport( + await testResponseHeadersReport( { ...COMPLIANT_API_HEADERS, "cross-origin-opener-policy": " Same-Origin ", @@ -179,11 +179,11 @@ test("falls back to empty headers if the response is missing", async () => { expect(await getResponseHeaders(null)).toEqual({}); }); -async function testResponseHeaderReport( +async function testResponseHeadersReport( headers: Record, type: ResponseHeaderType, ): Promise { await expect - .soft(responseHeaderReport(headers, { type })) + .soft(responseHeadersReport(headers, { type })) .toMatchTextFile({ fileExtension: "md" }); }