Set coi headers directly in lib/http-server.js; Add test

Author: TheSlowGrowth

bin/http-server

@@ -133,8 +133,6 @@ function listen(port) {
     password: argv.password || process.env.NODE_HTTP_SERVER_PASSWORD
   };
 
-  options.headers = {};
-
   if (argv.cors && argv.coi) {
     logger.info(colors.red('Error: conflicting arguments: --cors and --coi'));
     process.exit(1);
@@ -147,8 +145,7 @@ function listen(port) {
     }
   }
   else if (argv.coi) {
-    options.headers['Cross-Origin-Embedder-Policy'] = 'require-corp';
-    options.headers['Cross-Origin-Opener-Policy'] = 'same-origin';
+    options.coi = true;
   }
 
   if (ssl) {

lib/http-server.js

@@ -134,6 +134,11 @@ function HttpServer(options) {
     } : null));
   }
 
+  if (options.coi) {
+    this.headers['Cross-Origin-Embedder-Policy'] = 'require-corp';
+    this.headers['Cross-Origin-Opener-Policy'] = 'same-origin';
+  }
+
   if (options.robots) {
     before.push(function (req, res) {
       if (req.url === '/robots.txt') {

test/http-server-test.js

@@ -167,6 +167,26 @@ vows.describe('http-server').addBatch({
       server.close();
     }
   },
+  'When cross origin isolation is enabled,\n': {
+    topic: function () {
+      var server = httpServer.createServer({
+        root: root,
+        coi: true
+      });
+
+      server.listen(8080);
+      this.callback(null, server);
+    },
+    'and a page is requested': {
+      topic: function () {
+        request('http://127.0.0.1:8080/', this.callback);
+      },
+      'response should have cross origin isolation headers set': function (err, res) {
+        assert.equal(res.headers['Cross-Origin-Embedder-Policy'], 'require-corp');
+        assert.equal(res.headers['Cross-Origin-Opener-Policy'], 'same-origin');
+      }
+    }
+  },
   'When gzip and brotli compression is enabled and a compressed file is available': {
     topic: function () {
       var server = httpServer.createServer({