fix: add missing parameters on Cross-Origin-Embedder-Policy

reside-eng · Feb 2, 2022 · 6b9dc07 · 6b9dc07
1 parent ae1adbc
commit 6b9dc07
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/src/headers/cross-origin-embedder-policy/index.ts b/src/headers/cross-origin-embedder-policy/index.ts
@@ -5,7 +5,7 @@ import type { CrossOriginEmbedderPolicy } from './types';
 const HEADER_NAME = 'Cross-Origin-Embedder-Policy';
 
 const validation = directiveValidation(HEADER_NAME, {
-  allowedDirectives: ['require-corp'],
+  allowedDirectives: ['require-corp', 'unsafe-none', 'credentialless'],
 });
 
 /**

diff --git a/src/headers/cross-origin-embedder-policy/types.ts b/src/headers/cross-origin-embedder-policy/types.ts
@@ -13,4 +13,8 @@ export interface CrossOriginEmbedderPolicy extends FortifyHeader {
    * Allows the document to fetch cross-origin resources without giving explicit permission through the CORS protocol or the Cross-Origin-Resource-Policy header.
    */
   unsafeNone?: boolean;
+  /**
+   * Test for google
+   */
+  credentialless?: boolean;
 }