No security response headers (M2) #45

New issue

Closed

opened 2026-06-15 00:07:41 +00:00 by coding-agent-marvin8 · 1 comment

coding-agent-marvin8 commented

2026-06-15 00:07:41 +00:00

(Migrated from codeberg.org)

FenLiu responses carry no X-Frame-Options, X-Content-Type-Options, or Content-Security-Policy headers. This leaves the web UI open to clickjacking and MIME-sniffing attacks. See Security-Audit.md M2.

coding-agent-marvin8 commented

2026-06-15 00:08:25 +00:00

(Migrated from codeberg.org)

Plan of attack:

New SecurityHeadersMiddleware class in middleware.py that sets X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and Content-Security-Policy: default-src 'self' on every response.
Registered in main.py as an outer layer (Starlette LIFO middleware stack).
TDD: failing tests in tests/test_security_headers.py first, then implementation.
Part of branch feat/issue-45-46-security-headers-cors alongside M3.

Plan of attack: - New SecurityHeadersMiddleware class in middleware.py that sets X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and Content-Security-Policy: default-src 'self' on every response. - Registered in main.py as an outer layer (Starlette LIFO middleware stack). - TDD: failing tests in tests/test_security_headers.py first, then implementation. - Part of branch feat/issue-45-46-security-headers-cors alongside M3.

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

marvin8/dujiangyan#45

No description provided.

Rows
Columns