security.go RawHistoryFolder

1package middleware
2
3import (
4	"net/http"
5)
6
7// SecurityHeaders middleware adds standard security headers to HTTP responses.
8// This provides defense-in-depth against various web attacks.
9func SecurityHeaders(next http.Handler) http.Handler {
10	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
11		// Prevent MIME type sniffing
12		w.Header().Set("X-Content-Type-Options", "nosniff")
13
14		// Prevent clickjacking
15		w.Header().Set("X-Frame-Options", "DENY")
16
17		// XSS protection (legacy, but still useful for older browsers)
18		w.Header().Set("X-XSS-Protection", "1; mode=block")
19
20		// Control referrer information
21		w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
22
23		// Restrict browser features
24		w.Header().Set("Permissions-Policy", "geolocation=(), microphone=(), camera=()")
25
26		// HSTS: Enforce HTTPS-only for browsers. Only set when the request
27		// arrived over a real TLS connection. We do NOT trust X-Forwarded-Proto
28		// here because it is client-spoofable unless the request came from a
29		// trusted proxy, and we have no trusted-proxy list at this layer.
30		if r.TLS != nil {
31			w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
32		}
33
34		// NOTE: CSP is intentionally NOT set here. Gordon proxies arbitrary web
35		// apps, so a blanket "default-src 'none'" would break all proxied sites.
36		// Instead, CSP is set directly on proxy-generated error responses in the
37		// proxy error handlers (service.go).
38
39		next.ServeHTTP(w, r)
40	})
41}