header-grader 0.1.0 → 0.1.1

package/README.md

@@ -290,13 +290,23 @@ npm run typecheck   # tsc --noEmit
 npm run build       # tsup → dist/ (ESM + CJS + .d.ts)
 ```
 
-Try it against a deliberately bad server:
+No server handy? The repo ships two sample servers (also used as CI fixtures):
 
 ```sh
-node -e 'require("http").createServer((q,s)=>{s.setHeader("Content-Type","text/html");s.end("hi")}).listen(3456)' &
-node dist/cli.js localhost:3456 --fix express
+npm run demo:bare        # unhardened server on :3456, grades F
+npm run demo:hardened    # fully hardened server on :3457, grades A+
 ```
 
+Then, in another terminal:
+
+```sh
+node dist/cli.js localhost:3456 --explain        # see the F and why it matters
+node dist/cli.js localhost:3456 --fix express    # see the generated fix
+node dist/cli.js localhost:3457                  # see what A+ looks like
+```
+
+A note on grading real-world sites: header-grader evaluates exactly what the response sends, so even big-name production sites can score poorly. Some of that is deliberate tradeoff (for example, a domain baked into the browser HSTS preload list gains little from the HSTS header, and a Content-Security-Policy-Report-Only header monitors without enforcing, which earns partial credit here). The rubric is tuned for what YOUR app should send, not for excusing what large platforms can get away with.
+
 ## Roadmap
 
 - [ ] Caddy and Apache config generators

package/dist/{chunk-GQYXZFYW.js → chunk-CUWFMOK7.js}

@@ -39,6 +39,15 @@ var csp = {
   check(ctx) {
     const value = ctx.headers["content-security-policy"];
     if (!value) {
+      if (ctx.headers["content-security-policy-report-only"]) {
+        return result(
+          this,
+          "warn",
+          "Only Content-Security-Policy-Report-Only is set. Violations are reported but nothing is blocked; promote the policy to the enforcing header once the reports are clean.",
+          0.25,
+          RECOMMENDED["Content-Security-Policy"]
+        );
+      }
       return result(
         this,
         "fail",

package/dist/{chunk-O3B2LYGP.js → chunk-YQYAHLR6.js}

@@ -1,7 +1,7 @@
 import {
   formatReport,
   gradeHeaders
-} from "./chunk-GQYXZFYW.js";
+} from "./chunk-CUWFMOK7.js";
 
 // src/middleware.ts
 function headerGrader(options = {}) {

package/dist/{chunk-IW5F2ZYM.js → chunk-ZLAMK7PS.js}

@@ -1,6 +1,6 @@
 import {
   RECOMMENDED
-} from "./chunk-GQYXZFYW.js";
+} from "./chunk-CUWFMOK7.js";
 
 // src/generators/express.ts
 function generateExpress(report) {

package/dist/cli.cjs

@@ -42,6 +42,15 @@ var csp = {
   check(ctx) {
     const value = ctx.headers["content-security-policy"];
     if (!value) {
+      if (ctx.headers["content-security-policy-report-only"]) {
+        return result(
+          this,
+          "warn",
+          "Only Content-Security-Policy-Report-Only is set. Violations are reported but nothing is blocked; promote the policy to the enforcing header once the reports are clean.",
+          0.25,
+          RECOMMENDED["Content-Security-Policy"]
+        );
+      }
       return result(
         this,
         "fail",

package/dist/cli.js

@@ -2,13 +2,13 @@
 import {
   generateExpress,
   generateNginx
-} from "./chunk-IW5F2ZYM.js";
+} from "./chunk-ZLAMK7PS.js";
 import {
   formatReport,
   isGrade,
   meetsGrade,
   scan
-} from "./chunk-GQYXZFYW.js";
+} from "./chunk-CUWFMOK7.js";
 
 // src/cli.ts
 var HELP = `header-grader \u2014 grade your dev server's security headers

package/dist/index.cjs

@@ -79,6 +79,15 @@ var csp = {
   check(ctx) {
     const value = ctx.headers["content-security-policy"];
     if (!value) {
+      if (ctx.headers["content-security-policy-report-only"]) {
+        return result(
+          this,
+          "warn",
+          "Only Content-Security-Policy-Report-Only is set. Violations are reported but nothing is blocked; promote the policy to the enforcing header once the reports are clean.",
+          0.25,
+          RECOMMENDED["Content-Security-Policy"]
+        );
+      }
       return result(
         this,
         "fail",

package/dist/index.js

@@ -1,10 +1,10 @@
 import {
   generateExpress,
   generateNginx
-} from "./chunk-IW5F2ZYM.js";
+} from "./chunk-ZLAMK7PS.js";
 import {
   headerGrader
-} from "./chunk-O3B2LYGP.js";
+} from "./chunk-YQYAHLR6.js";
 import {
   EXPLOITS,
   RECOMMENDED,
@@ -18,7 +18,7 @@ import {
   runRules,
   scan,
   scoreOf
-} from "./chunk-GQYXZFYW.js";
+} from "./chunk-CUWFMOK7.js";
 export {
   EXPLOITS,
   RECOMMENDED,

package/dist/middleware.cjs

@@ -66,6 +66,15 @@ var csp = {
   check(ctx) {
     const value = ctx.headers["content-security-policy"];
     if (!value) {
+      if (ctx.headers["content-security-policy-report-only"]) {
+        return result(
+          this,
+          "warn",
+          "Only Content-Security-Policy-Report-Only is set. Violations are reported but nothing is blocked; promote the policy to the enforcing header once the reports are clean.",
+          0.25,
+          RECOMMENDED["Content-Security-Policy"]
+        );
+      }
       return result(
         this,
         "fail",

package/dist/middleware.js

@@ -1,8 +1,8 @@
 import {
   headerGrader,
   middleware_default
-} from "./chunk-O3B2LYGP.js";
-import "./chunk-GQYXZFYW.js";
+} from "./chunk-YQYAHLR6.js";
+import "./chunk-CUWFMOK7.js";
 export {
   middleware_default as default,
   headerGrader

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "header-grader",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Security header grader for local dev — grades your dev server's HTTP security headers and generates the Express/Nginx config to fix them.",
   "keywords": [
     "security",
@@ -40,6 +40,9 @@
   },
   "scripts": {
     "build": "tsup",
+    "demo:bare": "node test/fixtures/bare-server.mjs",
+    "demo:hardened": "node test/fixtures/hardened-server.mjs",
+    "prepublishOnly": "npm run typecheck && npm test && npm run build",
     "test": "vitest run",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit"