|
1 | 1 | import { writeFile, stat } from "node:fs/promises"; |
2 | 2 | import { z } from "zod"; |
3 | 3 |
|
| 4 | +/** |
| 5 | + * @link https://chatgpt.com/c/6795dae3-8a10-800e-96af-fd0d01579f39 |
| 6 | + * @link https://gemini.google.com/app/b47e9022a51a9846 |
| 7 | + * */ |
| 8 | +const responseOnlyHeaders = { |
| 9 | + "accept-patch": { |
| 10 | + proof: |
| 11 | + "Defined in RFC 5789, Section 3.1. Used by the server to indicate supported PATCH media types.", |
| 12 | + reason: |
| 13 | + "Servers use this header in responses to inform clients about supported PATCH formats.", |
| 14 | + }, |
| 15 | + "accept-post": { |
| 16 | + proof: "Part of the WebDAV specification (RFC 7240, Section 4).", |
| 17 | + reason: |
| 18 | + "Sent in responses to indicate the types of POST requests that a server supports.", |
| 19 | + }, |
| 20 | + "accept-ranges": { |
| 21 | + proof: "Defined in RFC 7233, Section 2.3.", |
| 22 | + reason: |
| 23 | + "The server uses this to tell the client it supports partial requests (e.g., byte ranges).", |
| 24 | + }, |
| 25 | + "access-control-allow-credentials": { |
| 26 | + proof: "Defined in CORS Specification (Fetch Standard, Section 6.2).", |
| 27 | + reason: "Used in responses to indicate support for credentials in CORS.", |
| 28 | + }, |
| 29 | + "access-control-allow-headers": { |
| 30 | + proof: "Defined in CORS Specification (Fetch Standard, Section 6.2).", |
| 31 | + reason: "Specifies allowed headers in preflight CORS responses.", |
| 32 | + }, |
| 33 | + "access-control-allow-methods": { |
| 34 | + proof: "Defined in CORS Specification (Fetch Standard, Section 6.2).", |
| 35 | + reason: "Specifies allowed HTTP methods in preflight CORS responses.", |
| 36 | + }, |
| 37 | + "access-control-allow-origin": { |
| 38 | + proof: "Defined in CORS Specification (Fetch Standard, Section 6.2).", |
| 39 | + reason: "Indicates allowed origins for CORS requests.", |
| 40 | + }, |
| 41 | + "access-control-expose-headers": { |
| 42 | + proof: "Defined in CORS Specification (Fetch Standard, Section 6.2).", |
| 43 | + reason: "Lists headers exposed to the client in CORS responses.", |
| 44 | + }, |
| 45 | + "access-control-max-age": { |
| 46 | + proof: "Defined in CORS Specification (Fetch Standard, Section 6.2).", |
| 47 | + reason: |
| 48 | + "Specifies how long preflight results can be cached in CORS responses.", |
| 49 | + }, |
| 50 | + age: { |
| 51 | + proof: "Defined in RFC 7234, Section 5.1.", |
| 52 | + reason: |
| 53 | + "Indicates the age of a cached response, a concept relevant only to responses.", |
| 54 | + }, |
| 55 | + allow: { |
| 56 | + proof: "Defined in RFC 7231, Section 7.4.1.", |
| 57 | + reason: "Used in responses to indicate supported methods for the resource.", |
| 58 | + }, |
| 59 | + "alt-svc": { |
| 60 | + proof: "Defined in RFC 7838, Section 3.", |
| 61 | + reason: "The server advertises alternative services in responses.", |
| 62 | + }, |
| 63 | + "cache-status": { |
| 64 | + proof: "Defined in RFC 9211.", |
| 65 | + reason: "Indicates the status of caching for the response.", |
| 66 | + }, |
| 67 | + "cdn-cache-control": { |
| 68 | + proof: |
| 69 | + "An extension header often used by CDNs to communicate caching strategies; see examples in CDN-specific docs (e.g., Akamai or Cloudflare).", |
| 70 | + reason: "Relevant to response caching.", |
| 71 | + }, |
| 72 | + "cdn-loop": { |
| 73 | + proof: "Defined in RFC 8586, Section 2.", |
| 74 | + reason: |
| 75 | + "Used to detect infinite loops within CDNs; appears only in responses.", |
| 76 | + }, |
| 77 | + "clear-site-data": { |
| 78 | + description: "Instructs the user agent to clear browsing data.", |
| 79 | + proof: "RFC 7873: Server instructs client to clear data.", |
| 80 | + }, |
| 81 | + "content-base": { |
| 82 | + proof: |
| 83 | + "Mentioned in early HTTP/1.1 specs (e.g., RFC 2068, Section 14.11). Deprecated, but applies only to server responses.", |
| 84 | + reason: "Specifies the base URL for relative URLs in a document.", |
| 85 | + }, |
| 86 | + "content-security-policy": { |
| 87 | + proof: "Defined in the CSP Specification.", |
| 88 | + reason: |
| 89 | + "Used to define security policies for the content delivered in the response.", |
| 90 | + }, |
| 91 | + "content-security-policy-report-only": { |
| 92 | + proof: "Defined in the CSP Specification.", |
| 93 | + reason: "A response-only variant of the CSP header for testing purposes.", |
| 94 | + }, |
| 95 | + "content-style-type": { |
| 96 | + proof: |
| 97 | + "Deprecated but mentioned in early specifications (e.g., HTML 4.01).", |
| 98 | + reason: |
| 99 | + "Indicates the default stylesheet language; used in responses only.", |
| 100 | + }, |
| 101 | + "content-version": { |
| 102 | + proof: "Part of early HTTP/1.1 drafts (e.g., RFC 2068, Section 14.14).", |
| 103 | + reason: "Specifies the version of the returned content; response-only.", |
| 104 | + }, |
| 105 | + etag: { |
| 106 | + proof: "Defined in RFC 7232, Section 2.3.", |
| 107 | + reason: |
| 108 | + "Used to identify the version of a resource; relevant only to responses.", |
| 109 | + }, |
| 110 | + expires: { |
| 111 | + proof: "Defined in RFC 7234, Section 5.3.", |
| 112 | + reason: "Indicates when the response content becomes stale.", |
| 113 | + }, |
| 114 | + "last-modified": { |
| 115 | + proof: "Defined in RFC 7232, Section 2.2.", |
| 116 | + reason: "Communicates the last modification date of the resource.", |
| 117 | + }, |
| 118 | + location: { |
| 119 | + proof: "Defined in RFC 7231, Section 7.1.2.", |
| 120 | + reason: |
| 121 | + "Used in redirection responses or to indicate the location of a created resource.", |
| 122 | + }, |
| 123 | + "optional-www-authenticate": { |
| 124 | + proof: "Defined in RFC 8053, Section 3.", |
| 125 | + reason: "Allows a server to provide optional authentication mechanisms.", |
| 126 | + }, |
| 127 | + "proxy-authenticate": { |
| 128 | + proof: "Defined in RFC 7235, Section 4.3.", |
| 129 | + reason: "Used in responses for proxy authentication.", |
| 130 | + }, |
| 131 | + "proxy-authentication-info": { |
| 132 | + proof: "Defined in RFC 7615, Section 3.", |
| 133 | + reason: |
| 134 | + "Used by the server to provide information about proxy authentication.", |
| 135 | + }, |
| 136 | + "proxy-status": { |
| 137 | + proof: "Defined in RFC 8586, Section 5.6.", |
| 138 | + reason: "Communicates proxy-specific status information in responses.", |
| 139 | + }, |
| 140 | + refresh: { |
| 141 | + proof: "A non-standard but widely used header (MDN Docs).", |
| 142 | + reason: "Indicates redirection or automatic page refresh.", |
| 143 | + }, |
| 144 | + "retry-after": { |
| 145 | + proof: "Defined in RFC 7231, Section 7.1.3.", |
| 146 | + reason: |
| 147 | + "Used in responses to indicate when the client should retry a request.", |
| 148 | + }, |
| 149 | + "sec-websocket-accept": { |
| 150 | + proof: "Defined in RFC 6455, Section 11.3.3.", |
| 151 | + reason: "Used in WebSocket handshake responses to confirm acceptance.", |
| 152 | + }, |
| 153 | + server: { |
| 154 | + proof: "Defined in RFC 7231, Section 7.4.2.", |
| 155 | + reason: "Identifies the server software handling the response.", |
| 156 | + }, |
| 157 | + "server-timing": { |
| 158 | + proof: "Defined in W3C Server Timing Specification.", |
| 159 | + reason: "Provides server-side timing metrics in responses.", |
| 160 | + }, |
| 161 | + "set-cookie": { |
| 162 | + proof: "Defined in RFC 6265, Section 4.1.", |
| 163 | + reason: "Used to set cookies in responses.", |
| 164 | + }, |
| 165 | + "set-cookie2": { |
| 166 | + proof: |
| 167 | + "Deprecated but appeared in earlier specs like RFC 2965, Section 3.3.3.", |
| 168 | + reason: "A legacy header for setting cookies.", |
| 169 | + }, |
| 170 | + "strict-transport-security": { |
| 171 | + proof: "Defined in RFC 6797, Section 6.1.", |
| 172 | + reason: "Enforces HTTPS policies in responses.", |
| 173 | + }, |
| 174 | + "surrogate-control": { |
| 175 | + proof: "Defined in CDN-specific documentation (e.g., Akamai, Cloudflare).", |
| 176 | + reason: "Used to manage CDN-specific cache behavior in responses.", |
| 177 | + }, |
| 178 | + "timing-allow-origin": { |
| 179 | + proof: "Defined in the Resource Timing Level 1 Spec.", |
| 180 | + reason: |
| 181 | + "Specifies which origins can access timing information in the response.", |
| 182 | + }, |
| 183 | + vary: { |
| 184 | + description: |
| 185 | + "Tells caches that the response is variant and lists the headers that determine the variance.", |
| 186 | + proof: "RFC 9110, 15.8: Server specifies response variations.", |
| 187 | + }, |
| 188 | + "www-authenticate": { |
| 189 | + proof: "Defined in RFC 7235, Section 4.1.", |
| 190 | + reason: "Used in responses for authentication challenges.", |
| 191 | + }, |
| 192 | +}; |
| 193 | + |
4 | 194 | const dest = "src/well-known-headers.json"; |
5 | 195 | const { mtime } = await stat(dest).then( |
6 | 196 | (stats) => stats, |
@@ -48,7 +238,8 @@ const headers = lines |
48 | 238 | if (!success) console.debug("excluding", entry); |
49 | 239 | return success; |
50 | 240 | }) |
51 | | - .map(({ name }) => name.toLowerCase()); |
| 241 | + .map(({ name }) => name.toLowerCase()) |
| 242 | + .filter((name) => !(name in responseOnlyHeaders)); |
52 | 243 |
|
53 | 244 | console.debug("CRC:", headers.length); |
54 | 245 |
|
|
0 commit comments