feat: helmet middleware for http_proto and unit tests.

Signed-off-by: Amlal El Mahrouss <[email protected]>

Author: amlel-el-mahrouss

include/boost/http_proto/server/helmet.hpp

@@ -0,0 +1,64 @@
+//
+// Copyright (c) 2025 Amlal El Mahrouss (amlal at nekernel dot org)
+//
+// Distributed under the Boost Software License, Version 1.0. (See accompanying
+// file LICENSE_1_0.txt or copy at http://www.boost.org/LICENSE_1_0.txt)
+//
+// Official repository: https://github.com/cppalliance/http_proto
+//
+
+#ifndef BOOST_HTTP_PROTO_SERVER_HELMET_HPP
+#define BOOST_HTTP_PROTO_SERVER_HELMET_HPP
+
+#include <boost/http_proto/detail/config.hpp>
+#include <boost/http_proto/server/route_handler.hpp>
+
+namespace boost {
+namespace http_proto {
+
+/// \brief Helmet middleware options.
+struct helmet_options final
+{
+    using helmet_pair = std::pair<std::string, std::vector<std::string>>;
+    using helmet_map     = std::vector<helmet_pair>;
+
+    /// \brief {key, enabled}
+    /// \note i.e {bad-header, false} <-- disabled
+    helmet_map requestHeaders = {
+        {"Content-Security-Policy", {"default-src 'self'", "base-uri 'self'", "font-src 'self' https: data:", "form-action 'self'", "frame-ancestors 'self'", 
+            "img-src 'self' data:", "object-src 'none'", "script-src 'self'", "script-src-attr 'none'", "style-src 'self' https: 'unsafe-inline'", "upgrade-insecure-requests"}},
+        {"Cross-Origin-Embedder-Policy", {"require-corp"}},
+        {"Cross-Origin-Opener-Policy", {"same-origin"}},
+        {"Cross-Origin-Resource-Policy", {"same-origin"}},
+        {"X-DNS-Prefetch-Control", {"off"}},
+        {"Expect-CT", {"max-age=86400, enforce"}},
+        {"X-Frame-Options", {"SAMEORIGIN"}},
+        {"X-Powered-By", {""}},  // Remove this header
+        {"Strict-Transport-Security", {"max-age=15552000", "includeSubDomains"}},
+        {"X-Download-Options", {"noopen"}},
+        {"X-Content-Type-Options", {"nosniff"}},
+        {"Origin-Agent-Cluster", {"?1"}},
+        {"X-Permitted-Cross-Domain-Policies", {"none"}},
+        {"Referrer-Policy", {"no-referrer"}},
+        {"X-XSS-Protection", {"0"}}  // Disabled as modern browsers have better protections
+    };
+};
+
+/// \brief Middleware inspired by express.js concept of helmets.
+class helmet
+{
+public:
+    BOOST_HTTP_PROTO_DECL
+    explicit helmet(
+        const helmet_options& options = {}) noexcept;
+
+    BOOST_HTTP_PROTO_DECL
+    route_result
+    operator()(route_params& p) const;
+
+private:
+    helmet_options options_;
+};
+}
+}
+#endif

src/server/helmet.cpp

@@ -0,0 +1,57 @@
+//
+// Copyright (c) 2025 Amlal El Mahrouss (amlal at nekernel dot org)
+//
+// Distributed under the Boost Software License, Version 1.0. (See accompanying
+// file LICENSE_1_0.txt or copy at http://www.boost.org/LICENSE_1_0.txt)
+//
+// Official repository: https://github.com/cppalliance/http_proto
+//
+
+#include <boost/http_proto/server/helmet.hpp>
+
+namespace boost {
+namespace http_proto {
+
+namespace detail {
+    auto setHeaderValues(std::vector<std::string>& fields_value) -> std::string {
+        if (fields_value.empty())
+            detail::throw_invalid_argument();
+
+        std::string res_value;
+        bool first = false;
+
+        for (const auto& value: fields_value)
+        {
+            if (first) res_value += "; ";
+            res_value += value;
+            first = true;
+        }
+
+        return res_value;
+    }
+}
+
+helmet::
+helmet(
+    const helmet_options& options) noexcept
+    : options_(std::move(options))
+{
+
+}
+
+route_result
+helmet::
+operator()(
+    route_params& p) const
+{
+    for (auto hdr : options_.requestHeaders)
+    {
+        auto view_res = detail::setHeaderValues(hdr.second);
+        p.res.set(hdr.first, view_res);
+    }
+
+    return route::next;
+}
+
+}
+}

test/unit/server/helmet.cpp

@@ -0,0 +1,26 @@
+//
+// Copyright (c) 2025 Amlal El Mahrouss (amlal at nekernel dot org)
+//
+// Distributed under the Boost Software License, Version 1.0. (See accompanying
+// file LICENSE_1_0.txt or copy at http://www.boost.org/LICENSE_1_0.txt)
+//
+// Official repository: https://github.com/cppalliance/http_proto
+//
+
+#include <boost/http_proto/server/helmet.hpp>
+#include "test_suite.hpp"
+
+namespace boost {
+namespace http_proto {
+
+struct helmet_test
+{
+    void run() {}
+};
+
+TEST_SUITE(
+    helmet_test,
+    "boost.http_proto.server.helmet");
+}
+
+}