rock-n-code/ccn
1
0
Fork 0
Code Issues Pull Requests Actions Projects Releases Activity

Security header setup for the Website service (#8)

Browse Source 
This PR contains the work done to add a `SecurityHeadersMiddleware` middleware that stamps hardened security-related HTTP headers onto every response.

To provide further details about the work:

* Implemented the `SecurityHeadersMiddleware` middleware, which precomputes headers once from a `Configuration` object and applies them to every response:
  * _Content-Security-Policy_,
  * _X-Content-Type-Options_,
  * _X-Frame-Options_,
  * _Referrer-Policy_,
  * _Permissions-Policy_,
  * _Strict-Transport-Security_ (optional).
* Integrated this middleware into the router (near the top of the chain), reading each value from configuration with hardened defaults.
* The _Strict-Transport-Security_ has no default value — omitted unless explicitly set, so it stays off in plain-HTTP during development and on only behind TLS.
* Added security-header constants keys and values.

Reviewed-on: rock-n-code/loud-amsterdam#8
Co-authored-by: Javier Cicchelli <javier@rock-n-code.com>
Co-committed-by: Javier Cicchelli <javier@rock-n-code.com>
This commit is contained in:
javier
2026-06-28 11:35:54 +00:00
committed by javier
parent 7c18cd9ec0
commit 6b6389cb0f
9 changed files with 497 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Services/Website/Sources/Library/Public/Extensions/AbsoluteConfigKey+Constants.swift
+15
View File
@@ -34,4 +34,19 @@ extension AbsoluteConfigKey {
/// The absolute configuration key for the directory the static files are served from.
public static let staticFiles: AbsoluteConfigKey = .init(.Path.staticFiles)
}
/// A namespace for the security headers configuration keys, as absolute keys.
public enum Security {
/// The absolute configuration key for the `Content-Security-Policy` header value.
public static let contentSecurityPolicy: AbsoluteConfigKey = .init(.Security.contentSecurityPolicy)
/// The absolute configuration key for the `X-Content-Type-Options` header value.
public static let contentTypeOptions: AbsoluteConfigKey = .init(.Security.contentTypeOptions)
/// The absolute configuration key for the `X-Frame-Options` header value.
public static let frameOptions: AbsoluteConfigKey = .init(.Security.frameOptions)
/// The absolute configuration key for the `Referrer-Policy` header value.
public static let referrerPolicy: AbsoluteConfigKey = .init(.Security.referrerPolicy)
/// The absolute configuration key for the `Permissions-Policy` header value.
public static let permissionsPolicy: AbsoluteConfigKey = .init(.Security.permissionsPolicy)
/// The absolute configuration key for the `Strict-Transport-Security` header value.
public static let strictTransportSecurity: AbsoluteConfigKey = .init(.Security.strictTransportSecurity)
}
}