Add baseline security headers; exempt doc-serving routes (L-3) #115

Merged

qwc merged 1 commit from feature/security-headers into main

2026-05-19 07:03:52 +02:00

qwc commented

2026-05-19 06:24:20 +02:00

Owner

Summary

New SecurityHeadersMiddleware sets X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, and Content-Security-Policy: frame-ancestors 'self' on app-owned UI responses (admin, login, profile, upload, API, project pages, frontpage).
Doc-serving routes (GET /project/{slug}/{version}/{path...}) are exempt because uploaded HTML may legitimately use inline scripts, embed third-party origins, or be intentionally framed.
Exemption is path-based; the /project/{slug}/version/{tag}/{action} action routes (delete, pin, download) keep the headers because their second segment is the literal "version".

Test plan

go test ./internal/handler/... — new TestSecurityHeadersMiddleware covers admin, login, profile, upload, version-action, download, API, frontpage, doc-serving exemption (with and without nested paths), and base-path variants.
go test ./... — full suite still green.
go build — clean.

Audit item: L-3 (Low / Sec).

🤖 Generated with Claude Code

## Summary - New `SecurityHeadersMiddleware` sets `X-Content-Type-Options: nosniff`, `Referrer-Policy: strict-origin-when-cross-origin`, and `Content-Security-Policy: frame-ancestors 'self'` on app-owned UI responses (admin, login, profile, upload, API, project pages, frontpage). - Doc-serving routes (`GET /project/{slug}/{version}/{path...}`) are exempt because uploaded HTML may legitimately use inline scripts, embed third-party origins, or be intentionally framed. - Exemption is path-based; the `/project/{slug}/version/{tag}/{action}` action routes (delete, pin, download) keep the headers because their second segment is the literal `"version"`. ## Test plan - [x] `go test ./internal/handler/...` — new `TestSecurityHeadersMiddleware` covers admin, login, profile, upload, version-action, download, API, frontpage, doc-serving exemption (with and without nested paths), and base-path variants. - [x] `go test ./...` — full suite still green. - [x] `go build` — clean. Audit item: **L-3** (Low / Sec). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

qwc added 1 commit

2026-05-19 06:24:20 +02:00

Add baseline security headers; exempt doc-serving routes (L-3)

CI / test (pull_request) Successful in 1m22s

Details

CI / build (pull_request) Successful in 52s

Details

CI / docker (pull_request) Has been skipped

Details

ff14aba4e8

Sets X-Content-Type-Options, Referrer-Policy, and CSP frame-ancestors on
responses for app-owned UI (admin, login, profile, upload, API, project
pages). The doc-serving route is exempt because uploaded HTML may rely
on inline scripts, third-party embeds, or be intentionally framed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

qwc merged commit e326bf7b69 into main

2026-05-19 07:03:52 +02:00

qwc deleted branch feature/security-headers

2026-05-19 07:03:52 +02:00

qwc referenced this pull request from a commit

2026-05-19 07:03:54 +02:00

Merge pull request 'Add baseline security headers; exempt doc-serving routes (L-3)' (#115) from feature/security-headers into main

qwc referenced this pull request from a commit

2026-07-13 13:19:10 +02:00

Merge pull request 'Add baseline security headers; exempt doc-serving routes (L-3)' (#115) from feature/security-headers into main