Lambda@Edge security headers

index.js

'use strict';

function addHeader(headers, key, value) {
    if (!headers[key.toLowerCase()]) {
        headers[key.toLowerCase()] = [{
            key,
            value,
        }];
    }
}

exports.handler = (event, context, callback) => {
    const { response } = event.Records[0].cf;
    const { headers } = response;
    
    addHeader(headers, 'Strict-Transport-Security', 'max-age=15552000');
    addHeader(headers, 'X-Frame-Options', 'SAMEORIGIN');
    addHeader(headers, 'X-XSS-Protection', '1; mode=block');
    addHeader(headers, 'X-Content-Type-Options', 'nosniff');
    addHeader(headers, 'Feature-Policy', "camera 'none'; geolocation 'none'; microphone 'none'");
    addHeader(headers, 'Referrer-Policy', 'same-origin');
    addHeader(headers, 'Content-Security-Policy', 'upgrade-insecure-requests');
    
    return callback(null, response);
};