@alxia/secure-headers 0.4.9 → 0.5.0

package/docs/troubleshooting.md

@@ -2,8 +2,9 @@
 
 Each entry is headed by the text you see: a TypeScript error, an exception,
 a browser console message, or a header that is or is not on a response.
-`secureHeaders` throws only at startup, on options it cannot send; what
-goes wrong otherwise is a type, a browser refusing what a header forbids,
+`secureHeaders`, `csp()`, `pageHeaders()` and `clearSiteData()` throw only
+at startup, on options they cannot send; `cacheControl` is an option of
+`secureHeaders`. What goes wrong otherwise is a type, a browser refusing what a header forbids,
 or a header in the wrong place.
 
 **Types**
@@ -14,14 +15,29 @@ or a header in the wrong place.
 - [`Type 'undefined' is not assignable to type 'SecureHeadersOptions & { readonly nonce: true; }'`](#type-undefined-is-not-assignable-to-type-secureheadersoptions---readonly-nonce-true-)
 - [`Property 'nonce' does not exist on type 'RouteBase<…>'`](#property-nonce-does-not-exist-on-type-routebase)
 - [`No overload matches this call` … `Type 'boolean' is not assignable to type 'true'`](#no-overload-matches-this-call--type-boolean-is-not-assignable-to-type-true)
+- [`Type 'string' is not assignable to type 'CspValue | undefined'`](#type-string-is-not-assignable-to-type-cspvalue--undefined)
+- [`Object literal may only specify known properties, and 'contentSecurityPolicy' does not exist in type 'PageHeadersOptions'`](#object-literal-may-only-specify-known-properties-and-contentsecuritypolicy-does-not-exist-in-type-pageheadersoptions)
+- [`Property 'https' is missing in type '{}' but required in type 'PageHeadersOptions'`](#property-https-is-missing-in-type--but-required-in-type-pageheadersoptions)
+- [`Type '"cash"' is not assignable to type '"cookies" | "*" | "cache" | "storage" | "executionContexts" | "clientHints" | "prefetchCache" | "prerenderCache"'`](#type-cash-is-not-assignable-to-type-cookies----cache--storage--executioncontexts--clienthints--prefetchcache--prerendercache)
 
 **Runtime**
 
 - [`TypeError: secureHeaders: … is empty; give false to leave the … header out`](#typeerror-secureheaders--is-empty-give-false-to-leave-the--header-out)
-- [`use(): argument 1 looks like a factory (secureHeaders): call it, use(secureHeaders())`](#use-argument-1-looks-like-a-factory-secureheaders-call-it-usesecureheaders)
+- [`use(): argument 1 looks like a factory (<name>): call it, use(<name>())`](#use-argument-1-looks-like-a-factory-name-call-it-usename)
 - [`TypeError: secureHeaders: nonce is on, but the content-security-policy has no script-src to add it to: …`](#typeerror-secureheaders-nonce-is-on-but-the-content-security-policy-has-no-script-src-to-add-it-to-)
 - [`TypeError: secureHeaders: nonce is on, but contentSecurityPolicy is false: …`](#typeerror-secureheaders-nonce-is-on-but-contentsecuritypolicy-is-false-)
 - [`TypeError: secureHeaders: contentSecurityPolicy names NONCE, but nonce is off: give nonce: true`](#typeerror-secureheaders-contentsecuritypolicy-names-nonce-but-nonce-is-off-give-nonce-true)
+- [`TypeError: csp(): <name> has no source: write ["'none'"] to allow nothing, or false to leave it out`](#typeerror-csp-name-has-no-source-write-none-to-allow-nothing-or-false-to-leave-it-out)
+- [`TypeError: csp(): "<name>" is not a directive name: write lowercase letters, digits and hyphens, starting with a letter, as in "script-src"`](#typeerror-csp-name-is-not-a-directive-name-write-lowercase-letters-digits-and-hyphens-starting-with-a-letter-as-in-script-src)
+- [`TypeError: csp(): <name> has the source "<source>", which is empty or holds ";", "," or a space: a source is one token, so split a list into several sources, and write a comma inside a URL as %2C`](#typeerror-csp-name-has-the-source-source-which-is-empty-or-holds---or-a-space-a-source-is-one-token-so-split-a-list-into-several-sources-and-write-a-comma-inside-a-url-as-2c)
+- [`TypeError: csp(): no directive is left: give at least one, such as { "default-src": ["'none'"] }`](#typeerror-csp-no-directive-is-left-give-at-least-one-such-as--default-src-none-)
+- [`TypeError: clearSiteData(): no type is given: write at least one, such as ["cache"]`](#typeerror-clearsitedata-no-type-is-given-write-at-least-one-such-as-cache)
+- [`TypeError: clearSiteData(): "<type>" is not a type: write one of "cache", "cookies", "storage", "executionContexts", "clientHints", "prefetchCache", "prerenderCache", "*"`](#typeerror-clearsitedata-type-is-not-a-type-write-one-of-cache-cookies-storage-executioncontexts-clienthints-prefetchcache-prerendercache-)
+- [`TypeError: pageHeaders(): script-src has no NONCE: a page script runs only with the response's nonce, so write script-src with NONCE in directives, such as ["'self'", NONCE, "'strict-dynamic'"]`](#typeerror-pageheaders-script-src-has-no-nonce-a-page-script-runs-only-with-the-responses-nonce-so-write-script-src-with-nonce-in-directives-such-as-self-nonce-strict-dynamic)
+- [`TypeError: pageHeaders(): script-src-elem has no NONCE: script elements follow it instead of script-src, so add NONCE to it, or give false to remove it`](#typeerror-pageheaders-script-src-elem-has-no-nonce-script-elements-follow-it-instead-of-script-src-so-add-nonce-to-it-or-give-false-to-remove-it)
+- [`TypeError: pageHeaders(): <name> cannot be removed from a page policy: …`](#typeerror-pageheaders-name-cannot-be-removed-from-a-page-policy-)
+- [`TypeError: csp(): <value> in <directive> is a keyword: write it quoted, '<value>'`](#typeerror-csp-value-in-directive-is-a-keyword-write-it-quoted-value)
+- [`TypeError: clearSiteData(): methods is empty or holds an empty method: write at least one, such as ["POST"], or leave methods out`](#typeerror-clearsitedata-methods-is-empty-or-holds-an-empty-method-write-at-least-one-such-as-post-or-leave-methods-out)
 
 **In the browser**
 
@@ -29,6 +45,7 @@ or a header in the wrong place.
 - [`Refused to send form data to '…' because it violates the following Content Security Policy directive: "form-action 'none'"`](#refused-to-send-form-data-to--because-it-violates-the-following-content-security-policy-directive-form-action-none)
 - [`Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' 'nonce-…'"`](#refused-to-execute-inline-script-because-it-violates-the-following-content-security-policy-directive-script-src-self-nonce-)
 - [Inline style attributes stop applying once `style-src` has the nonce](#inline-style-attributes-stop-applying-once-style-src-has-the-nonce)
+- [A third-party script or font is refused by a page policy](#a-third-party-script-or-font-is-refused-by-a-page-policy)
 - [`Refused to frame '…' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'none'"`](#refused-to-frame--because-an-ancestor-violates-the-following-content-security-policy-directive-frame-ancestors-none)
 - [`net::ERR_BLOCKED_BY_RESPONSE.NotSameOrigin`](#neterr_blocked_by_responsenotsameorigin)
 - [`window.opener` is `null` in a sign-in popup](#windowopener-is-null-in-a-sign-in-popup)
@@ -37,11 +54,13 @@ or a header in the wrong place.
 **Headers**
 
 - [An option has no effect on a response](#an-option-has-no-effect-on-a-response)
+- [A CDN still caches a page, though `cacheControl` is set](#a-cdn-still-caches-a-page-though-cachecontrol-is-set)
 - [`X-Powered-By` or `Server` is still sent](#x-powered-by-or-server-is-still-sent)
 - [A response arrives without the headers](#a-response-arrives-without-the-headers)
 - [A 404 or a route outside a group has no headers](#a-404-or-a-route-outside-a-group-has-no-headers)
 - [A `try`/`catch` middleware's reply has no headers](#a-trycatch-middlewares-reply-has-no-headers)
 - [A route has no headers, though the others do](#a-route-has-no-headers-though-the-others-do)
+- [`Clear-Site-Data` is missing on a client-side sign-out](#clear-site-data-is-missing-on-a-client-side-sign-out)
 
 ## Types
 
@@ -65,8 +84,9 @@ place of `'true'`.
 
 **Why:** a header option is the header's value as a string, or `false` to
 leave it out (`Setting`, exported, is `string | false`). There is no
-`true` — leaving the key out is the default — and no object form for a
-policy.
+`true` — leaving the key out is the default. The option takes a string,
+and `csp()` builds that string from directives
+([guide](guide.md#writing-the-policy-as-directives)).
 
 **Fix:** write the header as it goes out, or leave the key out:
 
@@ -216,6 +236,75 @@ const app = useNonce
 
 Or keep it on everywhere: the nonce costs one random draw per request.
 
+### `Type 'string' is not assignable to type 'CspValue | undefined'`
+
+**When:** a directive of `csp()`, or of `pageHeaders({ directives })`, is given a bare string instead of a list.
+
+```text
+error TS2322: Type 'string' is not assignable to type 'CspValue | undefined'.
+```
+
+**Why:** a directive's value is a list of sources (`readonly string[]`), `true` for a bare directive, or `false` to leave it out. One string would be one source, and a space inside it is refused at startup.
+
+**Fix:** write a list, even for one source:
+
+```ts
+csp({ 'script-src': ["'self'"] });
+```
+
+### `Object literal may only specify known properties, and 'contentSecurityPolicy' does not exist in type 'PageHeadersOptions'`
+
+**When:** `pageHeaders()` is given `contentSecurityPolicy`. `'nonce'` gives the same message, with the name changed.
+
+```text
+error TS2353: Object literal may only specify known properties, and 'contentSecurityPolicy' does not exist in type 'PageHeadersOptions'.
+```
+
+**Why:** a page policy is written through `directives`, merged over `PAGE_DIRECTIVES`, and always carries a nonce, so neither `contentSecurityPolicy` nor `nonce` is an option of `pageHeaders()`.
+
+**Fix:** use `directives`, and drop `nonce`:
+
+```ts
+pageHeaders({ https: true, directives: { 'img-src': ["'self'", 'https://img.example'] } });
+```
+
+For a whole policy of your own, use `secureHeaders({ nonce: true, contentSecurityPolicy: csp(…) })`.
+
+### `Property 'https' is missing in type '{}' but required in type 'PageHeadersOptions'`
+
+**When:** `pageHeaders({})`, or an options object without `https`.
+
+```text
+error TS2345: Argument of type '{}' is not assignable to parameter of type 'PageHeadersOptions'.
+  Property 'https' is missing in type '{}' but required in type 'PageHeadersOptions'.
+```
+
+**Why:** `https` switches HSTS and `upgrade-insecure-requests`, and the package never reads the environment to guess it.
+
+**Fix:** pass your own flag:
+
+```ts
+pageHeaders({ https: import.meta.env.PROD });
+```
+
+### `Type '"cash"' is not assignable to type '"cookies" | "*" | "cache" | "storage" | "executionContexts" | "clientHints" | "prefetchCache" | "prerenderCache"'`
+
+**When:** `clearSiteData(['cash'])`, a type the header does not know, or a type of `ClearSiteDataType` misspelled.
+
+```text
+error TS2322: Type '"cash"' is not assignable to type '"cookies" | "*" | "cache" | "storage" | "executionContexts" | "clientHints" | "prefetchCache" | "prerenderCache"'.
+```
+
+The union is `ClearSiteDataType`, written out.
+
+**Why:** the browser ignores a type it does not know, so the cache would stay as it was without a word.
+
+**Fix:** use one of the listed types, in a list:
+
+```ts
+clearSiteData(['cache']);
+```
+
 ## Runtime
 
 ### `TypeError: secureHeaders: … is empty; give false to leave the … header out`
@@ -237,20 +326,21 @@ Only `false` leaves a header out.
 app.use(secureHeaders({ xFrameOptions: false }));
 ```
 
-### `use(): argument 1 looks like a factory (secureHeaders): call it, use(secureHeaders())`
+### `use(): argument 1 looks like a factory (<name>): call it, use(<name>())`
 
-**When:** `alxia().use(secureHeaders)`, the factory given uncalled, in
-JavaScript or past a cast. It throws where the app is declared, since
+**When:** `alxia().use(secureHeaders)`, `use(pageHeaders)` or
+`use(clearSiteData)`, a factory given uncalled, in JavaScript or past a
+cast. `<name>` is the factory's. It throws where the app is declared, since
 alxia 0.5; before, each request was answered with a 500 and the log said
 `GET /: a middleware (secureHeaders) returned function: …`. TypeScript
 refuses it first, with `"this looks like a factory given uncalled: …"` in
 the error.
 
-**Why:** `use` takes a middleware, a `(ctx, next)` function; `secureHeaders`
-makes one, and is marked as a factory, so `use`, a route and `plugin`
-refuse it.
+**Why:** `use` takes a middleware, a `(ctx, next)` function; `secureHeaders`,
+`pageHeaders` and `clearSiteData` make one, and are marked as factories, so
+`use`, a route and `plugin` refuse them.
 
-**Fix:**
+**Fix:** call it:
 
 ```ts
 const app = alxia()
@@ -317,6 +407,174 @@ import { NONCE, secureHeaders } from '@alxia/secure-headers';
 app.use(secureHeaders({ nonce: true, contentSecurityPolicy: `script-src 'self' ${NONCE}` }));
 ```
 
+### `TypeError: csp(): <name> has no source: write ["'none'"] to allow nothing, or false to leave it out`
+
+**When:** `csp()` is given an empty array for a directive. It throws at once, so the app fails at startup:
+
+```text
+TypeError: csp(): <name> has no source: write ["'none'"] to allow nothing, or false to leave it out
+```
+
+**Why:** an empty list says nothing a browser can use, and omitting the directive is not the same as forbidding everything.
+
+**Fix:**
+
+```ts
+csp({ 'img-src': ["'none'"] }); // allow nothing
+csp({ 'img-src': false }); // leave the directive out
+```
+
+### `TypeError: csp(): "<name>" is not a directive name: write lowercase letters, digits and hyphens, starting with a letter, as in "script-src"`
+
+**When:** a key of the object is not lowercase letters, digits and hyphens starting with a letter, such as `scriptSrc`, `Script-Src` or `-x`. It throws at once, so the app fails at startup:
+
+```text
+TypeError: csp(): "<name>" is not a directive name: write lowercase letters, digits and hyphens, starting with a letter, as in "script-src"
+```
+
+**Why:** directive names are written as in the header; a camel-cased key would name a directive no browser knows, so it is refused, not sent.
+
+**Fix:**
+
+```ts
+csp({ 'script-src': ["'self'"] });
+```
+
+### `TypeError: csp(): <name> has the source "<source>", which is empty or holds ";", "," or a space: a source is one token, so split a list into several sources, and write a comma inside a URL as %2C`
+
+**When:** a source is an empty string, or holds `;`, `,` or whitespace, usually a whole list or a second directive in one string. It throws at once, so the app fails at startup:
+
+```text
+TypeError: csp(): <name> has the source "<source>", which is empty or holds ";", "," or a space: a source is one token, so split a list into several sources, and write a comma inside a URL as %2C
+```
+
+**Why:** a `;` would end the directive and start another, so a value could smuggle in a directive; a space would pass two sources as one; a `,` would split the header in two for a proxy. A comma inside a URL is legitimate, so percent-encode it as `%2C`.
+
+**Fix:**
+
+```ts
+csp({ 'img-src': ["'self'", 'data:'] }); // not ["'self' data:"]
+```
+
+### `TypeError: csp(): no directive is left: give at least one, such as { "default-src": ["'none'"] }`
+
+**When:** every directive is `false` or `undefined`, or the object is empty. It throws at once, so the app fails at startup:
+
+```text
+TypeError: csp(): no directive is left: give at least one, such as { "default-src": ["'none'"] }
+```
+
+**Why:** an empty policy is no policy; it would be sent as an empty header.
+
+**Fix:**
+
+```ts
+csp({ 'default-src': ["'none'"] });
+// or leave the header out: secureHeaders({ contentSecurityPolicy: false })
+```
+
+### `TypeError: clearSiteData(): no type is given: write at least one, such as ["cache"]`
+
+**When:** `clearSiteData([])`, called with no type, throws where the app is declared.
+
+**Why:** a `Clear-Site-Data` header with no value tells the browser nothing.
+
+**Fix:** name what to clear:
+
+```ts
+app.use('/sign-out', clearSiteData(['cache']));
+```
+
+### `TypeError: clearSiteData(): "<type>" is not a type: write one of "cache", "cookies", "storage", "executionContexts", "clientHints", "prefetchCache", "prerenderCache", "*"`
+
+**When:** a type is misspelled (`'cash'`) or is not one the header knows, past a cast or in JavaScript. TypeScript refuses it first.
+
+**Why:** the browser ignores a type it does not know, so the cache would stay as it was without a word.
+
+**Fix:** use one of the types the message lists:
+
+```ts
+app.use('/sign-out', clearSiteData(['cache', 'cookies']));
+```
+
+### `TypeError: pageHeaders(): script-src has no NONCE: a page script runs only with the response's nonce, so write script-src with NONCE in directives, such as ["'self'", NONCE, "'strict-dynamic'"]`
+
+**When:** `pageHeaders({ directives: { 'script-src': [...] } })` gives a `script-src` without `NONCE`, or `false`, and the app is declared.
+
+**Why:** a page script runs only with the response's nonce. A `script-src` that lacks `NONCE` would leave every script of the page refused, and the page would not hydrate.
+
+**Fix:** keep `NONCE` in the list you give, with `'strict-dynamic'` after it:
+
+```ts
+import { NONCE, pageHeaders } from '@alxia/secure-headers';
+
+pageHeaders({
+	https: true,
+	directives: { 'script-src': ["'self'", NONCE, "'strict-dynamic'"] },
+});
+```
+
+### `TypeError: pageHeaders(): script-src-elem has no NONCE: script elements follow it instead of script-src, so add NONCE to it, or give false to remove it`
+
+**When:** `pageHeaders({ directives: { 'script-src-elem': [...] } })` gives a `script-src-elem` list without `NONCE`.
+
+**Why:** browsers that support CSP level 3 check `<script>` elements against `script-src-elem` when it is present, and ignore `script-src` for them. A list without `NONCE` would leave every script of the page refused, and the page would not hydrate.
+
+**Fix:** add `NONCE` to the list, or give `false` to remove the directive so `script-src` governs again:
+
+```ts
+import { NONCE, pageHeaders } from '@alxia/secure-headers';
+
+pageHeaders({
+	https: true,
+	directives: { 'script-src-elem': ["'self'", NONCE, "'strict-dynamic'"] },
+});
+```
+
+### `TypeError: pageHeaders(): <name> cannot be removed from a page policy: …`
+
+**When:** `pageHeaders({ directives: { 'default-src': false } })`, or `false` or `true` for `base-uri` or `object-src`. The app fails where it is declared.
+
+```text
+TypeError: pageHeaders(): base-uri cannot be removed from a page policy: it has no fallback, so an injected <base> would redirect nonced relative scripts, so give it a list of sources
+```
+
+**Why:** `default-src` covers frame, media and child sources, and `base-uri` has no fallback, so without it an injected `<base>` would redirect the nonced relative scripts. `object-src` blocks plugin content.
+
+**Fix:** give the directive a list, or leave it out of `directives` to keep the preset's:
+
+```ts
+pageHeaders({ https: true, directives: { 'base-uri': ["'self'"] } });
+```
+
+### `TypeError: csp(): <value> in <directive> is a keyword: write it quoted, '<value>'`
+
+**When:** a source of `csp()` is `self`, `none`, `unsafe-inline`, `unsafe-eval`, `unsafe-hashes`, `strict-dynamic`, `wasm-unsafe-eval`, `report-sample` or `inline-speculation-rules`, or starts `nonce-`, `sha256-`, `sha384-` or `sha512-`, written without its single quotes (in any case). The same goes for `pageHeaders({ directives })`.
+
+```text
+TypeError: csp(): self in script-src is a keyword: write it quoted, 'self'
+```
+
+**Why:** a browser reads `self` as a host called `self`, not as this site, and ignores the keyword it meant. The policy would be looser or stricter than written, without a word.
+
+**Fix:** quote it inside the string:
+
+```ts
+csp({ 'script-src': ["'self'", NONCE] });
+```
+
+### `TypeError: clearSiteData(): methods is empty or holds an empty method: write at least one, such as ["POST"], or leave methods out`
+
+**When:** `clearSiteData(['cache'], { methods: [] })`, or a `methods` list that holds `''`. It throws where the app is declared.
+
+**Why:** with no method, the middleware would never send the header, and the sign-out would leave the cache as it was.
+
+**Fix:** name the methods, or leave `methods` out for `['POST']`:
+
+```ts
+clearSiteData(['cache'], { methods: ['POST', 'DELETE'] });
+```
+
 ## In the browser
 
 These messages are Chrome's wording; Firefox and Safari report the same
@@ -409,6 +667,26 @@ directive of their own:
 contentSecurityPolicy: `default-src 'self'; script-src 'self'; style-src-elem 'self' ${NONCE}; style-src-attr 'unsafe-inline'`,
 ```
 
+### A third-party script or font is refused by a page policy
+
+**When:** a page behind `pageHeaders()` loads a script, a stylesheet or a font from another origin, and the console reads `Refused to load the script 'https://…' because it violates the following Content Security Policy directive: "script-src 'self' 'nonce-…' 'strict-dynamic'"` (or `font-src 'self'`).
+
+**Why:** `PAGE_DIRECTIVES` allows this site only. A script another script adds is allowed through `'strict-dynamic'`; one named in the HTML needs the nonce, and a font needs its origin in `font-src`.
+
+**Fix:** extend the directive that loads it through `directives`, which replaces that directive's list, so repeat what it already holds:
+
+```ts
+pageHeaders({
+	https: true,
+	directives: {
+		'font-src': ["'self'", 'https://fonts.example'],
+		'style-src-elem': ["'self'", NONCE, 'https://fonts.example'],
+	},
+});
+```
+
+Never put the origin in `default-src`. Under `'strict-dynamic'` a third-party script is loaded by a nonced script, not by allowlisting its host: a script tag from another origin takes the page's `nonce` attribute, and a host in `script-src` is ignored by browsers that support `'strict-dynamic'`. To allow a host for images, extend `img-src` the same way, as in `directives: { 'img-src': ["'self'", 'https://img.example'] }`.
+
 ### `Refused to frame '…' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'none'"`
 
 **When:** a page puts a response of the app in an `<iframe>`. With the
@@ -501,6 +779,34 @@ const response = await app.request('/the-route');
 console.log(response.headers.get('content-security-policy'));
 ```
 
+### A CDN still caches a page, though `cacheControl` is set
+
+**When:** `cacheControl: 'private, no-store'` is set, and some pages are still
+stored by a cache.
+
+**Why:** a route that sets its own `Cache-Control` (a `reply` with
+`cache-control: public, max-age=…`, or a middleware after `secureHeaders`)
+keeps it: the option only fills a header the response lacks.
+
+**Fix:** drop the route's header, or give it the same value. Before, the
+route's own header wins:
+
+```ts
+app.get('/the-page', ({ reply }) =>
+	reply(200, html, { headers: { 'cache-control': 'public, max-age=60' } }),
+);
+```
+
+After, the route leaves it to `secureHeaders` (or says `private, no-store`
+itself):
+
+```ts
+app.get('/the-page', ({ reply }) => reply(200, html));
+
+const response = await app.request('/the-page');
+console.log(response.headers.get('cache-control')); // private, no-store
+```
+
 ### `X-Powered-By` or `Server` is still sent
 
 **When:** `hidePoweredBy` is on (the default), and one of them is on the
@@ -635,3 +941,19 @@ const app = alxia()
 	.use(secureHeaders())
 	.get('/early', ({ reply }) => reply(200, 'now covered'));
 ```
+
+### `Clear-Site-Data` is missing on a client-side sign-out
+
+**When:** a form sign-out empties the cache, but a client-side one (the button, a navigation) does not. `Clear-Site-Data` is on the response of `POST /sign-out` and absent from `POST /sign-out.data`.
+
+**Why:** React Router's single fetch posts the route's `.data` URL, a path `use('/sign-out', …)` does not cover. A route cannot set the header there either: that answer carries a redirect's cookies, not its other headers.
+
+**Fix:** mount the middleware on both paths:
+
+```ts
+const cleared = clearSiteData(['cache']);
+
+const app = alxia()
+	.use('/sign-out', cleared)
+	.use('/sign-out.data', cleared);
+```

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@alxia/secure-headers",
-	"version": "0.4.9",
+	"version": "0.5.0",
 	"description": "Secure HTTP headers for alxia: HSTS, CSP, nosniff and the rest, each one adjustable",
 	"license": "MIT",
 	"type": "module",
@@ -41,12 +41,12 @@
 		]
 	},
 	"devDependencies": {
-		"@alxia/core": "^0.14.0",
+		"@alxia/core": "^0.15.1",
 		"@types/bun": "^1.4.2",
 		"zod": "^4.2.0"
 	},
 	"peerDependencies": {
-		"@alxia/core": "^0.14.0",
+		"@alxia/core": "^0.15.1",
 		"typescript": "^6.0.3 || ^7.0.0"
 	}
 }