common/headers.aug

OpenID Connect login application · Source and specification

Files in this project

• main.aug
• client/contracts.aug
• client/endpoints.aug
• client/export.aug
• client/login.aug
• client/logout.aug
• client/protocol.aug
• client/session.aug
• client/views.aug
• common/export.aug
• common/headers.aug
• common/keys.aug
• common/settings.aug
• common/views.aug
• provider/authorization.aug
• provider/contracts.aug
• provider/credentials.aug
• provider/discovery.aug
• provider/export.aug
• provider/token.aug
• provider/userinfo.aug
• provider/views.aug

Code

Indentation

// aug-spec: "headers.aug.md" explains this file. Read it before changes; refresh with aug spec.
/** Responses containing identity data are never cached or embedded by another site. */
Explanation 1Explanation 2
securityHeaders():
    return Headers().with(name="cache-control", value="no-store").with(
        name="pragma",
        value="no-cache"
    ).with(
        name="x-content-type-options",
        value="nosniff"
    ).with(
        name="referrer-policy",
        value="no-referrer"
    ).with(
        name="content-security-policy",
        value="default-src 'self'; style-src 'unsafe-inline'; script-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'"
    )
/** Add a checked cookie without losing duplicate Set-Cookie response fields. */
Explanation 1Explanation 2
withCookie(Headers headers, string name, string value, string path, int maxAge, bool secure):
    result = headers
Explanation 1Explanation 2
    for content in cookie(name, value, path, maxAge, secure).all(name="set-cookie"):
        result = result.with(name="set-cookie", value=content)
    return result
import cookie from web

Braces

// aug-spec: "headers.aug.md" explains this file. Read it before changes; refresh with aug spec.
/** Responses containing identity data are never cached or embedded by another site. */
Explanation 1Explanation 2
securityHeaders() {
    return Headers().with(name="cache-control", value="no-store").with(
        name="pragma",
        value="no-cache"
    ).with(
        name="x-content-type-options",
        value="nosniff"
    ).with(
        name="referrer-policy",
        value="no-referrer"
    ).with(
        name="content-security-policy",
        value="default-src 'self'; style-src 'unsafe-inline'; script-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'"
    )
}
/** Add a checked cookie without losing duplicate Set-Cookie response fields. */
Explanation 1Explanation 2
withCookie(Headers headers, string name, string value, string path, int maxAge, bool secure) {
    result = headers
Explanation 1Explanation 2
    for content in cookie(name, value, path, maxAge, secure).all(name="set-cookie") {
        result = result.with(name="set-cookie", value=content)
    }
    return result
}
import cookie from web

Compiled specification

Interactions and sequences

securityHeaders · source

Responses containing identity data are never cached or embedded by another site. Failures can raise HttpError. It returns headers starting with a Headers and adding these fields in order: "cache-control" to "no-store", "pragma" to "no-cache", "x-content-type-options" to "nosniff", "referrer-policy" to "no-referrer", and "content-security-policy" to "default-src 'self'; style-src 'unsafe-inline'; script-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'". source

Checked interface

securityHeaders() returns Headers unless HttpError

Failures can raise HttpError.

withCookie · source

Add a checked cookie without losing duplicate Set-Cookie response fields. It takes headers as Headers, name, value, and path as strings, maxAge as an integer, and secure as a boolean. Failures can raise HttpError.

It sets result to headers. For each content in a snapshot of all on cookie with name, value, path, maxAge, and secure with name "set-cookie", it sets result to result with the header "set-cookie" set to content. After the loop, it returns result. source

Checked interface

withCookie(Headers headers, string name, string value, string path, int maxAge, bool secure) returns Headers unless HttpError

It takes headers as Headers, name, value, and path as strings, maxAge as an integer, and secure as a boolean. Failures can raise HttpError.

Dependencies

It uses cookie from web.

Built-in operations follow the language reference.