🛡️ CloudFront HTTPセキュリティヘッダー

exports.handler = async (event) => {
    const response = event.Records[0].cf.response;
    const headers = response.headers;
    
    // セキュリティヘッダーを追加
    headers['strict-transport-security'] = [{
        key: 'Strict-Transport-Security',
        value: 'max-age=31536000; includeSubdomains'
    }];
    headers['x-content-type-options'] = [{
        key: 'X-Content-Type-Options',
        value: 'nosniff'
    }];
    headers['x-frame-options'] = [{
        key: 'X-Frame-Options',
        value: 'DENY'
    }];
    
    return response;
};

function handler(event) {
    var response = event.response;
    var headers = response.headers;
    
    // セキュリティヘッダーを追加
    headers['strict-transport-security'] = { 
        value: 'max-age=31536000; includeSubdomains'
    };
    headers['x-content-type-options'] = { 
        value: 'nosniff'
    };
    headers['x-frame-options'] = { 
        value: 'DENY'
    };
    
    return response;
}