Security header setup for the Website service (#8)

This PR contains the work done to add a `SecurityHeadersMiddleware` middleware that stamps hardened security-related HTTP headers onto every response.

To provide further details about the work:

* Implemented the `SecurityHeadersMiddleware` middleware, which precomputes headers once from a `Configuration` object and applies them to every response:
  * _Content-Security-Policy_,
  * _X-Content-Type-Options_,
  * _X-Frame-Options_,
  * _Referrer-Policy_,
  * _Permissions-Policy_,
  * _Strict-Transport-Security_ (optional).
* Integrated this middleware into the router (near the top of the chain), reading each value from configuration with hardened defaults.
* The _Strict-Transport-Security_ has no default value — omitted unless explicitly set, so it stays off in plain-HTTP during development and on only behind TLS.
* Added security-header constants keys and values.

Reviewed-on: rock-n-code/loud-amsterdam#8
Co-authored-by: Javier Cicchelli <javier@rock-n-code.com>
Co-committed-by: Javier Cicchelli <javier@rock-n-code.com>

Services/Website/Sources/App/App+build.swift

@@ -6,8 +6,8 @@ import WebsiteCore
 
 /// Builds the website application.
 ///
-/// Reads the log level, server name, static files location, and minimum response size to
-/// compress from the configuration, then assembles the router, server configuration, and logger.
+/// Reads the log level, server name, static files location, minimum response size to compress, and
+/// security headers from the configuration, then assembles the router, server configuration, and logger.
 /// - Parameter reader: the configuration reader the values are read from.
 /// - Returns: the configured application, ready to run as a service.
 func application(
@@ -44,12 +44,16 @@ func application(
         forKey: .Path.staticFiles,
         default: .Path.staticResources
     )
+    let securityHeaders = securityHeaders(
+        reader: reader
+    )
 
     return Application(
         router: router(
             staticFilesPath: staticFilesPath,
             cacheControl: cacheControl,
             compressionMinResponseSize: compressionMinResponseSize,
+            securityHeaders: securityHeaders,
             logLevel: logLevel
         ),
         configuration: ApplicationConfiguration(
@@ -90,6 +94,44 @@ private func cacheControl(
     ])
 }
 
+/// Builds the security-headers configuration applied to every response.
+///
+/// Each header value falls back to the hardened default in `String.Security` when the matching
+/// configuration key is unset. `Strict-Transport-Security` has no default: it is read as an optional
+/// and omitted entirely unless explicitly configured, so it stays off in plain-HTTP development and
+/// is enabled only behind TLS in production.
+/// - Parameter reader: the configuration reader the header values are read from.
+/// - Returns: the configured security-headers configuration.
+private func securityHeaders(
+    reader: ConfigReader
+) -> SecurityHeadersMiddleware<AppRequestContext>.Configuration {
+    .init(
+        contentSecurityPolicy: reader.string(
+            forKey: .Security.contentSecurityPolicy,
+            default: .Security.contentSecurityPolicy
+        ),
+        contentTypeOptions: reader.string(
+            forKey: .Security.contentTypeOptions,
+            default: .Security.contentTypeOptions
+        ),
+        frameOptions: reader.string(
+            forKey: .Security.frameOptions,
+            default: .Security.frameOptions
+        ),
+        referrerPolicy: reader.string(
+            forKey: .Security.referrerPolicy,
+            default: .Security.referrerPolicy
+        ),
+        permissionsPolicy: reader.string(
+            forKey: .Security.permissionsPolicy,
+            default: .Security.permissionsPolicy
+        ),
+        strictTransportSecurity: reader.string(
+            forKey: .Security.strictTransportSecurity
+        )
+    )
+}
+
 /// Builds the application's logger.
 /// - Parameters:
 ///   - serverName: the label applied to the logger.
@@ -108,27 +150,37 @@ private func logger(
 
 /// Builds the application's router.
 ///
-/// Registers the request-logging middleware, the response-compression middleware that compresses
+/// Registers the request-logging middleware, the security-headers middleware that stamps the given
+/// `securityHeaders` onto every response, the response-compression middleware that compresses
 /// responses larger than `minimumResponseSizeToCompress` when the client advertises support, the
 /// not-found middleware that serves the error page, and the static file middleware that serves the
 /// contents of `staticFilesPath` (tagging responses with the given `cacheControl` directives), then
 /// adds the `RootController` routes that render the landing page.
+///
+/// The security-headers middleware sits just inside request logging so it covers every response that
+/// reaches a client — the landing page, the compressed responses, the rendered error page, and the
+/// served static files.
 /// - Parameters:
 ///   - staticFilesPath: the folder, relative to the working directory, the static files are served from.
 ///   - cacheControl: the cache-control directives applied to the served static files.
 ///   - compressionMinResponseSize: the minimum response body size, in bytes, before compression is applied.
+///   - securityHeaders: the security headers applied to every response.
 ///   - logLevel: the level the request-logging middleware logs at.
 /// - Returns: the configured router.
 private func router(
     staticFilesPath: String,
     cacheControl: CacheControl,
     compressionMinResponseSize: Int,
+    securityHeaders: SecurityHeadersMiddleware<AppRequestContext>.Configuration,
     logLevel: Logger.Level
 ) -> Router<AppRequestContext> {
     let router = Router(context: AppRequestContext.self)
 
     router.addMiddleware {
         LogRequestsMiddleware(logLevel)
+        SecurityHeadersMiddleware(
+            configuration: securityHeaders
+        )
         ResponseCompressionMiddleware(
             minimumResponseSizeToCompress: compressionMinResponseSize
         )