A02: add security response headers to the web surface #10

New issue

Closed

opened 2026-08-13 09:35:03 +00:00 by nalum · 0 comments

nalum commented

2026-08-13 09:35:03 +00:00

Owner

The server sets no security headers anywhere (cmd/server/server.go:156-176, web/web.go:28-58), and the ingress adds none. The embedded app is served without CSP, HSTS, X-Content-Type-Options, or frame-ancestors protection.

The session JWT is safe from XSS because the cookie is httpOnly, but any future XSS in the React app runs with no CSP backstop, and the app can be framed.

Fix — a small middleware on the root mux:

Content-Security-Policy: default-src 'self' (fonts and scripts are bundled, so this is cheap)
Strict-Transport-Security on the public hostname
X-Content-Type-Options: nosniff
frame-ancestors 'none' (or X-Frame-Options: DENY)

Source: OWASP Top 10 (2025) audit of v1.1.0, 2026-08-13. File references point at the v1.1.0 tree.

The server sets no security headers anywhere (`cmd/server/server.go:156-176`, `web/web.go:28-58`), and the ingress adds none. The embedded app is served without CSP, HSTS, `X-Content-Type-Options`, or frame-ancestors protection. The session JWT is safe from XSS because the cookie is httpOnly, but any future XSS in the React app runs with no CSP backstop, and the app can be framed. **Fix** — a small middleware on the root mux: - `Content-Security-Policy: default-src 'self'` (fonts and scripts are bundled, so this is cheap) - `Strict-Transport-Security` on the public hostname - `X-Content-Type-Options: nosniff` - `frame-ancestors 'none'` (or `X-Frame-Options: DENY`) --- Source: OWASP Top 10 (2025) audit of `v1.1.0`, 2026-08-13. File references point at the `v1.1.0` tree.

nalum added this to the v1.1.0 security audit milestone

2026-08-13 09:35:03 +00:00

nalum added the

web

security

severity/medium

labels

2026-08-13 09:35:03 +00:00

nalum added reference refs/tags/v1.1.0

2026-08-13 09:37:46 +00:00

nalum referenced this issue from a commit

2026-08-13 10:07:35 +00:00