skip to content

detached d075a17

fix(security): add Strict-Transport-Security header

commit: d075a17d96ea379e7e65364f4d3341da8a3c9bcc
author: Kit · 8mo ago · 2026-02-16 11:02 UTC
parent: 00a75bb
signature: SSH UnverifiedSHA256:H91DFuEG4jpk5edzLA4aUKkpv4zv9Q339ipRmkph6Tk The key is unknown

1 file · +1 -0

M src/hooks.server.ts +1 -0


@@ -15,6 +15,7 @@ function addSecurityHeaders(response: Response): Response {
15	15		headers.set('X-Content-Type-Options', 'nosniff');
16	16		headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
17	17		headers.set('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
	18	+	headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');
18	19
19	20		return new Response(response.body, {
20	21		status: response.status,


@@ -15,6 +15,7 @@ function addSecurityHeaders(response: Response): Response {
15		headers.set('X-Content-Type-Options', 'nosniff');	15		headers.set('X-Content-Type-Options', 'nosniff');
16		headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');	16		headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
17		headers.set('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');	17		headers.set('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
			18	+	headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');
18			19
19		return new Response(response.body, {	20		return new Response(response.body, {
20		status: response.status,	21		status: response.status,