Content-Security-Policy: base-uri

Author: snuggs

middleware/policy.es

@@ -57,6 +57,11 @@ const
     // script-src fallback
     = Array.from (scripts)
 
+, bases // base-uri
+    // default-src fallback
+    = Array.from (defaults)
+
+
 , directives = [
   // Reporting directives
     `report-to ${ reports.join ` ` }`
@@ -74,7 +79,7 @@ const
   , `worker-src ${ workers.join ` ` }`
 
 // Document directives
-//  , `base-uri ${ bases.join ` ` }`
+  , `base-uri ${ bases.join ` ` }`
 //  , `sandbox ${ sandboxes.join ` ` }`
 //  , `plugin-types ${ plugins.join ` ` }`
 

middleware/policy.test

@@ -230,6 +230,24 @@ test ("Content-Security-Policy: worker-src", async t => {
 })
 
 
+test ("Content-Security-Policy: base-uri", async t => {
+
+  const
+    server = (new Server).serve ``
+
+  , response = await
+      fetch ('http://localhost:8181/')
+
+  , policy = response.headers.get ('content-security-policy')
+
+
+  t.ok ( policy.includes (`base-uri ${defaults}`) )
+
+  server.close ``
+  t.end ()
+})
+
+
 test ("Content-Security-Policy: block-all-mixed-content", async t => {
 
   const