Security headers middleware: CSP, Referrer-Policy, nosniff (#59) #76

Merged

poslop merged 1 commits from issue-59-security-headers into main

2026-09-09 14:26:01 +00:00

Author	SHA1	Message	Date
palette-agent	e08cafe9c8	security headers middleware: CSP, Referrer-Policy, nosniff on HTML pages (#59 ) CI / docker (pull_request) Skipped Details CI / test (pull_request) Successful in 30s Details - web.SecurityHeaders middleware wired into the chi router - Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' (page scripts are inline); frame-ancestors 'none' - Referrer-Policy: no-referrer, X-Content-Type-Options: nosniff - Applied only to text/html responses; JSON API and /raw pass through unchanged - Regression test internal/web/securityheaders_test.go	2026-09-09 09:16:42 -05:00

Author

SHA1

Message

Date

palette-agent

e08cafe9c8

security headers middleware: CSP, Referrer-Policy, nosniff on HTML pages (#59 )

CI / docker (pull_request) Skipped

Details

CI / test (pull_request) Successful in 30s

Details

- web.SecurityHeaders middleware wired into the chi router
- Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' (page scripts are inline); frame-ancestors 'none'
- Referrer-Policy: no-referrer, X-Content-Type-Options: nosniff
- Applied only to text/html responses; JSON API and /raw pass through unchanged
- Regression test internal/web/securityheaders_test.go

2026-09-09 09:16:42 -05:00