Content-Security-Policy and other security-related headers for Node.js and AWS Lambda (for webinista.com, tiffanybbrown.com)

index.js

'use strict';

exports.handler = (event, context, callback) => {
    const request = event.Records[0].cf.request;
    const response = event.Records[0].cf.response;

    // frame-src is deprecated, but Chrome AFAIK doesn't yet support child-src. Using both here.
    response.headers['content-security-policy'] = [{
        key: 'Content-Security-Policy',
        value: "default-src 'self'; script-src 'self' https://webinista.us3.list-manage.com; font-src https://*; frame-src 'self' *.tiffanybbrown.com *.webinista.com; child-src 'self' *.tiffanybbrown.com *.webinista.com; img-src https://*; block-all-mixed-content"
    }];
    
    response.headers['x-xss-protection'] = [{
        key: "X-XSS-Protection",
        value: "1; mode=block"
    }];
    
    response.headers['referrer-policy'] = [{
        key: "Referrer-Policy",
        value: "no-referrer"
    }];
    
    response.headers['x-content-type-options'] = [{
        key: "X-Content-Type-Options",
        value: "nosniff"
    }];
    
    response.headers['x-frame-options'] = [{
        key: "X-Frame-Options",
        value: "DENY"
    }];
    
    response.headers['strict-transport-security'] = [{
        key: "Strict-Transport-Security",
        value: "max-age=31536000; includeSubDomains"
    }];
    

    callback(null, response);
};