in packages/secure-static-site/lib/responseHeaders.ts [148:168]
export function getFunctionCode(httpHeaders?: ResponseHeaders): string {
const headers: Record<string, unknown> = httpHeaders?.custom || {};
if (httpHeaders?.contentSecurityPolicy !== false) {
headers["content-security-policy"] = {
value: getCsp(httpHeaders?.contentSecurityPolicy),
};
}
if (httpHeaders?.strictTransportSecurity !== false) {
headers["strict-transport-security"] = {
value: getSts(httpHeaders?.strictTransportSecurity),
};
}
if (httpHeaders?.contentTypeOptions !== false) {
headers["x-content-type-options"] = {
value: httpHeaders?.contentTypeOptions || "nosniff",
};
}
return readFileSync(resolve(__dirname, "./viewerResponseFn.js"))
.toString()
.replace("{{ADDITIONAL_HEADERS}}", JSON.stringify(headers));
}