palette

3 Commits

Include renames

Author	SHA1	Message	Date
fen	073d39ccba	Fix #116 : allow inline styles in CSP (style-src 'self' 'unsafe-inline') CI / test (pull_request) Successful in 24s Details CI / docker (pull_request) Skipped Details	2026-09-09 21:18:53 -05:00
fen	3d415edbdc	fix #84 : security headers dropped because they were set post-flush; set pre-handler CI / test (pull_request) Successful in 21s Details CI / docker (pull_request) Skipped Details	2026-09-09 10:54:16 -05:00
palette-agent	e08cafe9c8	security headers middleware: CSP, Referrer-Policy, nosniff on HTML pages (#59 ) CI / test (pull_request) Successful in 30s Details CI / docker (pull_request) Skipped Details - web.SecurityHeaders middleware wired into the chi router - Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' (page scripts are inline); frame-ancestors 'none' - Referrer-Policy: no-referrer, X-Content-Type-Options: nosniff - Applied only to text/html responses; JSON API and /raw pass through unchanged - Regression test internal/web/securityheaders_test.go	2026-09-09 09:16:42 -05:00