DO NOT MERGE: PR preview E2E fixture B

web/cloudflare-worker/src/index.ts

@@ -90,6 +90,8 @@ function buildAssetRequest(request: Request, url: URL, pathSuffix = ''): Request
 }
 
 function setSecurityHeaders(headers: Headers, environment: Env['ENVIRONMENT'] | DevelopmentEnv['ENVIRONMENT'], nonce: string, developmentOrigins?: DevelopmentOrigins) {
+    // Paired with the HTML marker to distinguish Worker code from Static Assets during the E2E experiment.
+    headers.set('X-Preview-Experiment', 'B-adhoc-v1');
     headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');
     headers.set('Content-Security-Policy', getCSP(environment, nonce, developmentOrigins));
     headers.set('X-Frame-Options', 'SAMEORIGIN');

web/cloudflare-worker/tests/worker.test.ts

@@ -29,6 +29,7 @@ function getHTMLNonce(html: string): string | undefined {
 }
 
 function assertSecurityHeaders(response: Response) {
+    assert.equal(response.headers.get('X-Preview-Experiment'), 'B-adhoc-v1');
     assert.equal(response.headers.get('Strict-Transport-Security'), 'max-age=31536000; includeSubDomains; preload');
     assert.equal(response.headers.get('X-Frame-Options'), 'SAMEORIGIN');
     assert.equal(response.headers.get('X-Content-Type-Options'), 'nosniff');

web/index.html

@@ -2,6 +2,7 @@
 <html lang="en">
 <head>
     <meta charset="utf-8" />
+    <meta name="adhoc-experiment" content="B-adhoc-v1" />
     <title>New Expensify</title>
     <meta name="description" content="Corporate cards, reimbursements, receipt scanning, invoicing, and bill pay.">
     <meta name="theme-color" content="#03D47C">