chore(test): add test for cache control and security headers

handler/middleware/cross_site_request_forgery.go

@@ -2,11 +2,10 @@ package middleware
 
 import (
 	"fmt"
+	"net/http"
 	"strings"
 
 	"me-fit/service"
-
-	"net/http"
 )
 
 type csrfResponseWriter struct {

handler/middleware/logger.go

@@ -1,12 +1,12 @@
 package middleware
 
 import (
-	"me-fit/log"
-
 	"net/http"
 	"strconv"
 	"time"
 
+	"me-fit/log"
+
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/promauto"
 )

handler/middleware/security_headers.go

@@ -7,33 +7,26 @@ import (
 )
 
 func SecurityHeaders(serverSettings *types.Settings) func(http.Handler) http.Handler {
-	cspValues := map[string]string{
-		"default-src":     "'none'",
-		"script-src":      "'self' https://umami.me-fit.eu",
-		"connect-src":     "'self' https://umami.me-fit.eu",
-		"img-src":         "'self'",
-		"style-src":       "'self'",
-		"form-action":     "'self'",
-		"frame-ancestors": "'none'",
-	}
-
-	var csp string
-	for key, value := range cspValues {
-		csp += key + " " + value + "; "
-	}
 
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			w.Header().Set("X-Content-Type-Options", "nosniff")
 			w.Header().Set("Access-Control-Allow-Origin", serverSettings.BaseUrl)
 			w.Header().Set("Access-Control-Allow-Methods", "GET, POST, DELETE")
-			w.Header().Set("Content-Security-Policy", csp)
+			w.Header().Set("Content-Security-Policy",
+				"default-src 'none';"+
+					"script-src 'self' https://umami.me-fit.eu"+
+					"connect-src 'self' https://umami.me-fit.eu"+
+					"img-src 'self'"+
+					"style-src 'self'"+
+					"form-action 'self'"+
+					"frame-ancestors 'none'",
+			)
 			w.Header().Set("Cross-Origin-Resource-Policy", "same-origin")
 			w.Header().Set("Cross-Origin-Opener-Policy", "same-origin")
 			w.Header().Set("Cross-Origin-Embedder-Policy", "require-corp")
-			w.Header().Set("Permissions-Policy", "geolocation=(), camera=(), microphone=()")
+			w.Header().Set("Permissions-Policy", "geolocation=(), camera=(), microphone=(), interest-cohort=()")
 			w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
-			w.Header().Set("Permissions-Policy", "interest-cohort=()")
 			w.Header().Set("Strict-Transport-Security", "max-age=63072000; includeSubDomains; preload")
 
 			if r.Method == "OPTIONS" {