diff --git a/services/security-headers/security-headers.service.js b/services/security-headers/security-headers.service.js index 4deb2abe1c55e9e2eb1cc3df538f2f64d3a78c00..2816da7adf8ea927598aea4e88f59cfc365a322b 100644 --- a/services/security-headers/security-headers.service.js +++ b/services/security-headers/security-headers.service.js @@ -6,6 +6,7 @@ const { BaseService, NotFound } = require('..') const queryParamSchema = Joi.object({ url: optionalUrl.required(), + ignoreRedirects: Joi.equal(''), }).required() const documentation = ` @@ -38,6 +39,15 @@ module.exports = class SecurityHeaders extends BaseService { }), documentation, }, + { + title: "Security Headers (Don't follow redirects)", + namedParams: {}, + queryParams: { url: 'https://www.shields.io', ignoreRedirects: null }, + staticPreview: this.render({ + grade: 'R', + }), + documentation, + }, ] static defaultBadgeData = { @@ -53,6 +63,7 @@ module.exports = class SecurityHeaders extends BaseService { D: 'orange', E: 'orange', F: 'red', + R: 'blue', } return { @@ -61,7 +72,7 @@ module.exports = class SecurityHeaders extends BaseService { } } - async handle(namedParams, { url }) { + async handle(namedParams, { url, ignoreRedirects }) { const { res } = await this._request({ url: `https://securityheaders.com`, options: { @@ -69,7 +80,7 @@ module.exports = class SecurityHeaders extends BaseService { qs: { q: url, hide: 'on', - followRedirects: 'on', + followRedirects: ignoreRedirects !== undefined ? null : 'on', }, }, }) diff --git a/services/security-headers/security-headers.tester.js b/services/security-headers/security-headers.tester.js index 2fa884e23e25dbce1ccb96f6cd687e02f0646573..f3c4e3b1266c31c725f0d96b13eca3b8295c3801 100644 --- a/services/security-headers/security-headers.tester.js +++ b/services/security-headers/security-headers.tester.js @@ -2,6 +2,10 @@ const t = (module.exports = require('../tester').createServiceTester()) -t.create('grade of http://shields.io') +t.create('grade of https://shields.io') .get('/security-headers.json?url=https://shields.io') .expectBadge({ label: 'security headers', message: 'F', color: 'red' }) + +t.create('grade of https://httpstat.us/301 as redirect') + .get('/security-headers.json?ignoreRedirects&url=https://httpstat.us/301') + .expectBadge({ label: 'security headers', message: 'R', color: 'blue' })