feat: Added useXFrameOptions() composable.

src/internals/useXFrameOptions.ts

@@ -0,0 +1,33 @@
+/*****************************************************************************************************************/
+
+// @author         Michael Roberts <michael@observerly.com>
+// @package        @observerly/nitro-helmet
+// @license        Copyright © 2021-2023 observerly
+
+/*****************************************************************************************************************/
+
+import { type H3Event, setHeader } from 'h3'
+
+import { type XFrameOptions } from './types'
+
+/*****************************************************************************************************************/
+
+export const defaultXFrameOptions = 'SAMEORIGIN'
+
+/*****************************************************************************************************************/
+
+export const useXFrameOptions = (
+  event: H3Event,
+  policy: XFrameOptions | boolean = defaultXFrameOptions
+) => {
+  if (typeof policy === 'boolean' && !policy) {
+    return
+  }
+
+  // If the policy is a boolean, then use the default policy:
+  if (typeof policy === 'boolean') {
+    policy = defaultXFrameOptions
+  }
+
+  setHeader(event, 'X-Frame-Options', policy)
+}

tests/mocks/helmet.ts

@@ -57,6 +57,8 @@ import {
   defaultXDownloadOptions
 } from '../../src/internals/useXDownloadOptions'
 
+import { useXFrameOptions, defaultXFrameOptions } from '../../src/internals/useXFrameOptions'
+
 /*****************************************************************************************************************/
 
 export const helmetHandlers: Handler[] = [
@@ -385,6 +387,39 @@ export const helmetHandlers: Handler[] = [
     handler: eventHandler(async event => {
       useXDownloadOptions(event, false)
 
+      return {
+        policy: false
+      }
+    })
+  },
+  {
+    method: 'GET',
+    url: '/helmet/x-frame-options',
+    handler: eventHandler(async event => {
+      useXFrameOptions(event, 'SAMEORIGIN')
+
+      return {
+        policy: 'SAMEORIGIN'
+      }
+    })
+  },
+  {
+    method: 'GET',
+    url: '/helmet/default-x-frame-options',
+    handler: eventHandler(async event => {
+      useXFrameOptions(event)
+
+      return {
+        policy: defaultXFrameOptions
+      }
+    })
+  },
+  {
+    method: 'GET',
+    url: '/helmet/no-x-frame-options',
+    handler: eventHandler(async event => {
+      useXFrameOptions(event, false)
+
       return {
         policy: false
       }

tests/useXFrameOptions.spec.ts

@@ -0,0 +1,52 @@
+/*****************************************************************************************************************/
+
+// @author         Michael Roberts <michael@observerly.com>
+// @package        @observerly/nitro-helmet
+// @license        Copyright © 2021-2023 observerly
+
+/*****************************************************************************************************************/
+
+import { beforeEach, describe, expect, it } from 'vitest'
+
+import supertest, { type SuperTest, type Test } from 'supertest'
+
+import { toNodeListener } from 'h3'
+
+import { server } from './utilities/server'
+
+import { defaultXFrameOptions, useXFrameOptions } from '../src/internals/useXFrameOptions'
+
+/*****************************************************************************************************************/
+
+describe('useXFrameOptions', () => {
+  let request: SuperTest<Test>
+
+  beforeEach(() => {
+    request = supertest(toNodeListener(server))
+  })
+
+  it('should be defined', () => {
+    expect(useXFrameOptions).toBeDefined()
+  })
+
+  it('should set X-Frame-Options on the request', async () => {
+    const res = await request.get('/helmet/x-frame-options', {
+      method: 'GET'
+    })
+    expect(res.header['x-frame-options']).toEqual('SAMEORIGIN')
+  })
+
+  it('should set X-Frame-Options on the request', async () => {
+    const res = await request.get('/helmet/default-x-frame-options', {
+      method: 'GET'
+    })
+    expect(res.header['x-frame-options']).toEqual(defaultXFrameOptions)
+  })
+
+  it('should not set X-Frame-Options on the request', async () => {
+    const res = await request.get('/helmet/no-x-frame-options', {
+      method: 'GET'
+    })
+    expect(res.header['x-frame-options']).toEqual(undefined)
+  })
+})