File Coverage

blib/lib/Plack/Middleware/SecureHeaders.pm

Criterion	Covered	Total	%
statement	28	28	100.0
branch	8	8	100.0
condition			n/a
subroutine	7	7	100.0
pod	2	2	100.0
total	45	45	100.0

package Plack::Middleware::SecureHeaders;
use strict;
use warnings;
use parent qw( Plack::Middleware );

our $VERSION = "0.01";

use HTTP::SecureHeaders;
use Plack::Util::Accessor qw(
    secure_headers
);

sub prepare_app {
    my $self = shift;
    unless (defined $self->secure_headers) {
        $self->secure_headers(HTTP::SecureHeaders->new)
    }
}

sub call {
    my($self, $env) = @_;

    my $res = $self->app->($env);
    my $headers = Plack::Util::headers($res->[1]);

    unless ($headers->exists('Content-Type')) {
        die sprintf('Required Content-Type header. %s %s', $env->{REQUEST_METHOD}, $env->{PATH_INFO});
    }

    # NOTE: the charset attribute is necessary to prevent XSS in HTML pages
    # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#content-type
    if ($headers->get('Content-Type') =~ qr!^text/html!i) {
        unless ($headers->get('Content-Type') =~ qr!charset=\w+!) {
            die sprintf('Required charset for text/html. %s %s', $env->{REQUEST_METHOD}, $env->{PATH_INFO})
        }
    }

    $self->secure_headers->apply($headers);

    return $res;
}

1;
__END__