common/headers.aug diagrams

OpenID Connect login application

Project overview · Compiled explanation

Sequences

Call arrows identify checked targets; loop and branch frames determine when they run. Open that target’s module to follow its implementation. Branches describe alternatives; loops describe repeated work. Native calls and interface dispatch stop at their declared contracts. Exit notes end that path; enclosing recovery and cleanup remain visible.

securityHeaders

Source

Responses containing identity data are never cached or embedded by another site.

Failures can raise HttpError.

100%

Mermaid source

sequenceDiagram
    participant p0 as securityHeaders

    p0->>p0: Headers()
    p0-->>p0: Headers result: Headers
    p0->>p0: Headers result.with(name=”cache-control”,<br/>value=”no-store”)
    p0-->>p0: with result: Headers
    p0->>p0: with result.with(name=”pragma”, value=”no-cache”)
    p0-->>p0: with result 2: Headers
    p0->>p0: with result 2.with(name=”x-content-type-options”,<br/>value=”nosniff”)
    p0-->>p0: with result 3: Headers
    p0->>p0: with result 3.with(name=”referrer-policy”,<br/>value=”no-referrer”)
    p0-->>p0: with result 4: Headers
    p0->>p0: with result 4.with(name=”content-security-policy”,<br/>value=”default-src 'self'； style-src 'unsafe-inline'；<br/>script-src 'self'； frame-ancestors 'none'； base-uri<br/>'none'； form-action 'self'”)
    p0-->>p0: with result 5: Headers
    Note over p0: Return Headers().with(name=”cache-control”,<br/>value=”no-store”).with(name=”pragma”,<br/>value=”no-cache”).with(name=”x-content-type-options”,<br/>value=”nosniff”).with(name=”referrer-policy”,<br/>value=”no-referrer”).with(name=”content-security-policy”,<br/>value=”default-src 'self'； style-src 'unsafe-inline'；<br/>script-src 'self'； frame-ancestors 'none'； base-uri<br/>'none'； form-action 'self'”)； required cleanup runs<br/>before exit
    Note over p0: May leave with checked errors: HttpError

withCookie

Source

Add a checked cookie without losing duplicate Set-Cookie response fields.

It takes headers as Headers, name, value, and path as strings, maxAge as an integer, and secure as a boolean.

Failures can raise HttpError.

100%

Mermaid source

sequenceDiagram
    participant p0 as withCookie
    participant p1 as web/contracts
    Note over p0: Set result to headers
    p0->>p1: cookie(name=name, value=value, path=path, maxAge=maxAge,<br/>secure=secure)
    p1-->>p0: cookie result: Headers
    p0->>p0: cookie result.all(name=”set-cookie”)
    p0-->>p0: all result: List‹string›
    loop For each item in cookie(name, value, path, maxAge,<br/>secure).all(name=”set-cookie”)
    p0->>p0: result.with(name=”set-cookie”, value=content)
    p0-->>p0: result: Headers
    end
    Note over p0: Return result； required cleanup runs before exit
    Note over p0: May leave with checked errors: HttpError

Called contracts

• cookie — package/@git/url_897efafd565158fc4908@0.0.0-git.a39fc582565d4fca40be4f75fa304d71adc69301/contracts.aug