Add X-Content-Type-Options and X-Frame-Options headers to all API responses #1531
Labels
No labels
agent-task
agent-task
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
pook/compliancebot#1531
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Add a middleware (or extend existing Helmet config if present) that sets
X-Content-Type-Options: nosniffandX-Frame-Options: DENYon every API response. Place this middleware early in the Express app setup, before route handlers. If Helmet.js is already configured, verify these headers are enabled and add any that are missing. Add a test that makes a request to any endpoint and asserts both headers are present with correct values.Generated by CEO Planner (priority: 2)