fix(security): add security headers middleware

commit: 643740b8fec51d043a3041b6de6e2ae3edf474b4
author: bnema · 9mo ago · 2026-01-17 20:58 UTC
parent: 6f1f4f3
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

1 file · +28 -0

A internal/adapters/in/http/middleware/security.go +28 -0

@@ -0,0 +1,28 @@
	1	+	package middleware
	2	+
	3	+	import (
	4	+	"net/http"
	5	+	)
	6	+
	7	+	// SecurityHeaders middleware adds standard security headers to HTTP responses.
	8	+	// This provides defense-in-depth against various web attacks.
	9	+	func SecurityHeaders(next http.Handler) http.Handler {
	10	+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	11	+	// Prevent MIME type sniffing
	12	+	w.Header().Set("X-Content-Type-Options", "nosniff")
	13	+
	14	+	// Prevent clickjacking
	15	+	w.Header().Set("X-Frame-Options", "DENY")
	16	+
	17	+	// XSS protection (legacy, but still useful for older browsers)
	18	+	w.Header().Set("X-XSS-Protection", "1; mode=block")
	19	+
	20	+	// Control referrer information
	21	+	w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
	22	+
	23	+	// Restrict browser features
	24	+	w.Header().Set("Permissions-Policy", "geolocation=(), microphone=(), camera=()")
	25	+
	26	+	next.ServeHTTP(w, r)
	27	+	})
	28	+	}

@@ -0,0 +1,28 @@
	1	+	package middleware
	2	+
	3	+	import (
	4	+	"net/http"
	5	+	)
	6	+
	7	+	// SecurityHeaders middleware adds standard security headers to HTTP responses.
	8	+	// This provides defense-in-depth against various web attacks.
	9	+	func SecurityHeaders(next http.Handler) http.Handler {
	10	+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	11	+	// Prevent MIME type sniffing
	12	+	w.Header().Set("X-Content-Type-Options", "nosniff")
	13	+
	14	+	// Prevent clickjacking
	15	+	w.Header().Set("X-Frame-Options", "DENY")
	16	+
	17	+	// XSS protection (legacy, but still useful for older browsers)
	18	+	w.Header().Set("X-XSS-Protection", "1; mode=block")
	19	+
	20	+	// Control referrer information
	21	+	w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
	22	+
	23	+	// Restrict browser features
	24	+	w.Header().Set("Permissions-Policy", "geolocation=(), microphone=(), camera=()")
	25	+
	26	+	next.ServeHTTP(w, r)
	27	+	})
	28	+	}