"use strict";
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.secureExpressApp = void 0;
const helmet_1 = __importDefault(require("helmet"));
const rejectBadHeaders = (req, res, next) => {
    if (req.headers['challenge-bypass-token']) {
        res.status(400).send('Bad Request');
    }
    else {
        next();
    }
};
exports.secureExpressApp = (app) => {
    // This is meant to provide some security across a wide range of
    // attacks. It is mentioned in the express docs under
    // Production Best Practices: Security
    // https://expressjs.com/en/advanced/best-practice-security.html
    // It's not entirely clear that this is helpful
    app.use(helmet_1.default());
    // Fix a known bad
    app.use(rejectBadHeaders);
};
//# sourceMappingURL=index.js.map