poslop/palette
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Security headers middleware: CSP, Referrer-Policy, nosniff (#59) #76

Merged
poslop merged 1 commits from issue-59-security-headers into main 2026-09-09 14:26:01 +00:00
Conversation 0 Commits 1 Files Changed 3
+77
poslop commented 2026-09-09 14:16:58 +00:00
Owner
Copy Link
Copy Source

Adds web.SecurityHeaders middleware (issue #59):

  • Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; frame-ancestors 'none' (page scripts are inline)
  • Referrer-Policy: no-referrer
  • X-Content-Type-Options: nosniff

Applied to all rendered HTML responses (page templates + inline can page); /api and /raw pass through unchanged. Closes #59.

Adds `web.SecurityHeaders` middleware (issue #59): - Content-Security-Policy: `default-src 'self'; script-src 'self' 'unsafe-inline'; frame-ancestors 'none'` (page scripts are inline) - Referrer-Policy: no-referrer - X-Content-Type-Options: nosniff Applied to all rendered HTML responses (page templates + inline can page); `/api` and `/raw` pass through unchanged. Closes #59.
poslop added 1 commit 2026-09-09 14:16:58 +00:00
security headers middleware: CSP, Referrer-Policy, nosniff on HTML pages (#59)
CI / docker (pull_request) Skipped
Details
CI / test (pull_request) Successful in 30s
Details
e08cafe9c8 
- web.SecurityHeaders middleware wired into the chi router
- Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' (page scripts are inline); frame-ancestors 'none'
- Referrer-Policy: no-referrer, X-Content-Type-Options: nosniff
- Applied only to text/html responses; JSON API and /raw pass through unchanged
- Regression test internal/web/securityheaders_test.go
poslop merged commit 44fe3c5772 into main 2026-09-09 14:26:01 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
Assigned
Owner assigned: agent may pick this up
 Critical
critical severity (pentest triage)
 High
high severity (pentest triage)
 In Progress
Agent actively working on this
 Low
low severity (pentest triage)
 Medium
medium severity (pentest triage)
 Owner Review
Blocked on a human decision or design call - poslop must review before work proceeds
 QA
Implementation done, awaiting independent review agent
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
fen poslop
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: poslop/palette#76