harden production headers and probe contract

2026-09-06 19:53:30 +03:00
parent e3f0192070
commit d3e8c9d6ed
4 changed files with 83 additions and 15 deletions
@@ -1,16 +1,62 @@
 {
-  "date": "2026-09-06",
-  "image": "ihaleist-qa:local",
+  "base": "http://127.0.0.1:18081",
+  "readOnly": true,
+  "checkedAt": "2026-09-06T16:53:08.051Z",
  "checks": {
-    "nginxConfigTest": "successful",
-    "apiHealth": {"status": 200, "body": {"ok": true}},
-    "apiReady": {"status": 200, "body": {"ok": true, "ready": true, "checks": {"userData": {"ok": true}, "sharedData": {"ok": true}}}},
-    "runtimeNpmAudit": {"high": 0, "critical": 0, "total": 0},
-    "staticSecurityHeaders": {
-      "x-content-type-options": "nosniff",
-      "referrer-policy": "no-referrer",
-      "permissions-policy": "camera=(), microphone=(), geolocation=()"
+    "home": {
+      "status": 200,
+      "contentType": "text/html",
+      "headers": {
+        "x-content-type-options": "nosniff",
+        "referrer-policy": "no-referrer",
+        "permissions-policy": "camera=(), microphone=(), geolocation=()",
+        "x-frame-options": "DENY",
+        "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; script-src 'self' https://accounts.google.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: blob: https:; connect-src 'self' https:; worker-src 'self' blob:; frame-src 'self' https://accounts.google.com",
+        "strict-transport-security": "max-age=31536000; includeSubDomains"
+      }
+    },
+    "health": {
+      "status": 200,
+      "contentType": "application/json; charset=utf-8",
+      "headers": {
+        "x-content-type-options": "nosniff",
+        "referrer-policy": "no-referrer",
+        "permissions-policy": "camera=(), microphone=(), geolocation=()",
+        "x-frame-options": "DENY",
+        "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; script-src 'self' https://accounts.google.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: blob: https:; connect-src 'self' https:; worker-src 'self' blob:; frame-src 'self' https://accounts.google.com",
+        "strict-transport-security": "max-age=31536000; includeSubDomains"
+      },
+      "json": {
+        "ok": true
+      },
+      "apiSuccess": true
+    },
+    "ready": {
+      "status": 200,
+      "contentType": "application/json; charset=utf-8",
+      "headers": {
+        "x-content-type-options": "nosniff",
+        "referrer-policy": "no-referrer",
+        "permissions-policy": "camera=(), microphone=(), geolocation=()",
+        "x-frame-options": "DENY",
+        "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; script-src 'self' https://accounts.google.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: blob: https:; connect-src 'self' https:; worker-src 'self' blob:; frame-src 'self' https://accounts.google.com",
+        "strict-transport-security": "max-age=31536000; includeSubDomains"
+      },
+      "json": {
+        "ok": true,
+        "ready": true,
+        "checks": {
+          "userData": {
+            "ok": true
+          },
+          "sharedData": {
+            "ok": true
+          }
+        }
+      },
+      "apiSuccess": true
    }
  },
-  "scope": "Local Docker image; no production deployment or external side effect"
+  "pass": true,
+  "missingHeaders": []
 }