feat: add security headers middleware #76

Merged

pook merged 1 commit from feat/security-headers into main

2026-04-09 06:13:38 -04:00

pook commented

2026-04-08 17:17:46 -04:00

Owner

Summary

Adds middleware setting 5 security headers (HSTS, X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy) on every response
Registered before route handlers in the middleware chain
Includes unit tests verifying all headers on both 200 and 404 responses
No CORS logic included (separate task per #39)

Test plan

Unit tests pass: bun test packages/api/tests/unit/security-headers.test.ts (2 pass, 0 fail)
Manual verification: check response headers on any endpoint

Refs #39

🤖 Generated with Claude Code

## Summary - Adds middleware setting 5 security headers (HSTS, X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy) on every response - Registered before route handlers in the middleware chain - Includes unit tests verifying all headers on both 200 and 404 responses - No CORS logic included (separate task per #39) ## Test plan - [x] Unit tests pass: `bun test packages/api/tests/unit/security-headers.test.ts` (2 pass, 0 fail) - [ ] Manual verification: check response headers on any endpoint Refs #39 🤖 Generated with [Claude Code](https://claude.com/claude-code)

pook added 1 commit

2026-04-08 17:17:46 -04:00

feat: add security headers middleware

agent-worker/pr-tests Running PR tests...

8b813f8b0f

Set Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options,
X-XSS-Protection, and Referrer-Policy on every response. Applied before
route handlers. Includes unit tests verifying all 5 headers.

Refs #39

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

pook commented

2026-04-08 17:18:13 -04:00

Author

Owner