feat(api): emit security response headers on every response (PMS-388) #367

Merged

nrupard merged 4 commits from feat/PMS-388-app-level-security-headers into main

2026-06-29 21:31:53 +02:00

Claude-Run commented

2026-06-26 08:29:35 +02:00

Member

Three of the four browser-facing surfaces shipped with no security response headers; only bunyip-api set a full set. The 2026-06-17 standup rejected the shared Traefik headers-security@docker middleware (broad blast radius: an attempt broke Mokosh and knocked out Bunyip until manual recovery) and moved the fix to the application layer.

This is the mokosh-server half: a global security_headers middleware (parity with bunyip-api's .wrap(SecurityHeaders)) layered on the outermost router so it covers the API, the portal API, and the not_a_frontend fallback uniformly. It sets HSTS (max-age=31536000; includeSubDomains; preload), X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: no-referrer, a deny-by-default Permissions-Policy, and a CSP tuned for this surface (default-src 'none' with style-src 'unsafe-inline' so the inline-styled fallback page renders, plus frame-ancestors 'none', base-uri 'none', form-action 'none').

The module is gated behind the server feature since it depends on axum. Unit tests assert the full header set and the HSTS/frame-deny/nosniff values are present on a response.

#PMS-388

Three of the four browser-facing surfaces shipped with no security response headers; only bunyip-api set a full set. The 2026-06-17 standup rejected the shared Traefik `headers-security@docker` middleware (broad blast radius: an attempt broke Mokosh and knocked out Bunyip until manual recovery) and moved the fix to the application layer. This is the mokosh-server half: a global `security_headers` middleware (parity with bunyip-api's `.wrap(SecurityHeaders)`) layered on the outermost router so it covers the API, the portal API, and the `not_a_frontend` fallback uniformly. It sets HSTS (max-age=31536000; includeSubDomains; preload), X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: no-referrer, a deny-by-default Permissions-Policy, and a CSP tuned for this surface (default-src 'none' with style-src 'unsafe-inline' so the inline-styled fallback page renders, plus frame-ancestors 'none', base-uri 'none', form-action 'none'). The module is gated behind the `server` feature since it depends on axum. Unit tests assert the full header set and the HSTS/frame-deny/nosniff values are present on a response. #PMS-388

Claude-Run added 1 commit

2026-06-26 08:29:35 +02:00

feat(api): emit security response headers on every response (PMS-388)

E2E / Playwright against staging (pull_request) Successful in 35s

Details

Integration / integration tests (pull_request) Failing after 1m18s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 1m26s

Details

dc6a8baf1d

Three of the four browser-facing surfaces shipped with no security response headers; only bunyip-api set a full set. The 2026-06-17 standup rejected the shared Traefik `headers-security@docker` middleware (broad blast radius: an attempt broke Mokosh and knocked out Bunyip until manual recovery) and moved the fix to the application layer.

This is the mokosh-server half: a global `security_headers` middleware (parity with bunyip-api's `.wrap(SecurityHeaders)`) layered on the outermost router so it covers the API, the portal API, and the `not_a_frontend` fallback uniformly. It sets HSTS (max-age=31536000; includeSubDomains; preload), X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: no-referrer, a deny-by-default Permissions-Policy, and a CSP tuned for this surface (default-src 'none' with style-src 'unsafe-inline' so the inline-styled fallback page renders, plus frame-ancestors 'none', base-uri 'none', form-action 'none').

The module is gated behind the `server` feature since it depends on axum. Unit tests assert the full header set and the HSTS/frame-deny/nosniff values are present on a response.

#PMS-388

vas2000-work added 1 commit

2026-06-28 02:07:22 +02:00