1# The forge's own pages, through Caddy, carry its security headers: HSTS,2# no sniffing, the origin alone as referrer, and a CSP that keeps them out3# of other sites' frames. A site (anyone's pages) gets only HSTS, which is4# the hostname's, and the sign-in page keeps its own stricter policy.5. "$(dirname "$0")/../lib.sh"6user dami7repo dami/greet8clone dami dami/greet "$T/w/d"9at "$T/w/d" commit "first"10push_as dami "$T/w/d" origin main11mkdir -p "$T/site" && printf '<h1>docs</h1>\n' >"$T/site/index.html"12FORGE_USER=dami ok at "$T/w/d" "$FORGE" site push "$T/site" docs13build14caddy_server15for p in / /dami/greet/ /dami/nope/; do16 http -s -i "$C$p" | tr -d '\r' >"$T/res"17 has "$T/res" '^Strict-Transport-Security: max-age=31536000$'18 has "$T/res" '^X-Content-Type-Options: nosniff$'19 has "$T/res" '^Referrer-Policy: strict-origin-when-cross-origin$'20 has "$T/res" "^Content-Security-Policy: frame-ancestors 'self'; base-uri 'none'; object-src 'none'$"21done22http -s -i "$C/sites/dami/greet/docs/" | tr -d '\r' >"$T/site.res"23has "$T/site.res" '^HTTP/1.1 200 '24has "$T/site.res" '<h1>docs</h1>'25has "$T/site.res" '^Strict-Transport-Security: '26lacks "$T/site.res" '^(Content-Security-Policy|X-Content-Type-Options|Referrer-Policy):'27http -s -i "$C/login/" | tr -d '\r' >"$T/login"28eq "$(grep -c '^Content-Security-Policy:' "$T/login")" 129has "$T/login" "^Content-Security-Policy: default-src 'self'.*frame-ancestors 'none'"30has "$T/login" '^Referrer-Policy: same-origin$'