Secure headers and CSRF in Hono, as an exercise

What you'll learn

Add the browser security headers Hono sets by default and know what each one prevents
Override one header, turn one off, and write a Content-Security-Policy as an object
Refuse cross-site form submissions with csrf(), and understand why a JSON request is not its concern

Press Run tests to start the app. Its log appears here.

Defaults such as nosniff and no-referrer, the two overridden values, and the policy written as an object
A form post with an Origin that is not the allowed one: csrf() answers 403 Forbidden and the handler never runs
No Origin and no Sec-Fetch-Site: the request cannot prove where it came from, so it is refused
The allowed origin passes and the handler answers
A JSON body cannot come from a plain HTML form, so csrf() leaves it to CORS; the handler answers

run the tests first