From 49dc77d2410d2da2530c3b7189cc8e439615e56b Mon Sep 17 00:00:00 2001 From: nutcas3 Date: Fri, 1 May 2026 09:05:02 +0300 Subject: [PATCH] feat: Add CSP, Referrer-Policy, and Permissions-Policy headers to SecurityHeadersMiddleware - Add Content-Security-Policy header with self-only defaults and unsafe-inline styles - Add Referrer-Policy header with strict-origin-when-cross-origin - Add Permissions-Policy header blocking geolocation, microphone, and camera access --- apps/api-server/internal/middleware/performance.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/apps/api-server/internal/middleware/performance.go b/apps/api-server/internal/middleware/performance.go index 369563c..c6d3b5c 100644 --- a/apps/api-server/internal/middleware/performance.go +++ b/apps/api-server/internal/middleware/performance.go @@ -260,6 +260,9 @@ func SecurityHeadersMiddleware() gin.HandlerFunc { c.Header("X-Frame-Options", "DENY") c.Header("X-XSS-Protection", "1; mode=block") c.Header("Strict-Transport-Security", "max-age=31536000; includeSubDomains") + c.Header("Content-Security-Policy", "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'") + c.Header("Referrer-Policy", "strict-origin-when-cross-origin") + c.Header("Permissions-Policy", "geolocation=(), microphone=(), camera=()") c.Next() } }