HSTS: throw when misspelling "includeSubDomains" option

See [#462] and [#464]. [#462]: #462 [#464]: #464
helmetjs · Apr 28, 2024 · 2ccdab6 · 2ccdab6
1 parent 7b94a6c
commit 2ccdab6
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 7 deletions.
diff --git a/middlewares/strict-transport-security/index.ts b/middlewares/strict-transport-security/index.ts
@@ -29,7 +29,7 @@ function getHeaderValueFromOptions(
     );
   }
   if ("includeSubdomains" in options) {
-    console.warn(
+    throw new Error(
       'Strict-Transport-Security middleware should use `includeSubDomains` instead of `includeSubdomains`. (The correct one has an uppercase "D".)',
     );
   }

diff --git a/test/strict-transport-security.test.ts b/test/strict-transport-security.test.ts
@@ -87,12 +87,9 @@ describe("Strict-Transport-Security middleware", () => {
   });
 
   it("logs a warning when using the mis-capitalized `includeSubdomains` parameter", () => {
-    jest.spyOn(console, "warn").mockImplementation(() => {});
-
-    strictTransportSecurity({ includeSubdomains: false } as any);
-
-    expect(console.warn).toHaveBeenCalledTimes(1);
-    expect(console.warn).toHaveBeenCalledWith(
+    expect(() =>
+      strictTransportSecurity({ includeSubdomains: false } as any),
+    ).toThrow(
       'Strict-Transport-Security middleware should use `includeSubDomains` instead of `includeSubdomains`. (The correct one has an uppercase "D".)',
     );
   });