question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Expect-CT: put max-age first

See original GitHub issue

It’s a little weird that max-age comes second after enforce:

https://github.com/helmetjs/helmet/blob/936cd27c91364a91d108a9fe31b81c92fb423338/middlewares/expect-ct/index.ts#L24-L28

We should reorder these lines and update the tests.

Issue Analytics

  • State:closed
  • Created 3 years ago
  • Comments:8 (8 by maintainers)

github_iconTop GitHub Comments

1reaction
EvanHahncommented, Aug 2, 2020

Helmet 4 (and expect-ct@1.0.0) was just released, so feel free to go ahead with your change. No rush, though!

0reactions
EvanHahncommented, Sep 28, 2020

Closed by #264.

Read more comments on GitHub >

github_iconTop Results From Across the Web

A new security header: Expect-CT - Scott Helme
If with the 30-second max-age, it was confirmed that the SCT is valid, the user should be fine to then set that max-age...
Read more >
Access-Control-Max-Age - HTTP - MDN Web Docs
The Access-Control-Max-Age response header indicates how long the results of a preflight request (that is the information contained in the ...
Read more >
Adding Expect-CT header to HTTP response
In the security test report, I have a recommendation to add Expect-CT header to the HTTP response from web ...
Read more >
Expect-CT Extension for HTTP RFC 9163 - IETF Datatracker
The first time a UA connects to a host, it lacks the information ... (A max-age directive need not appear in every Expect-CT...
Read more >
Caching Header Best Practices - Simon Hearne
Always set the Cache-Control header, preferably with the value max-age=31536000,immutable alongside unique asset filenames (or no-cache for non- ...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found