mattnite
/
forgejo-tickets
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add security response headers 

Fixes #18

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Matthew Knight 2026-02-17 16:00:56 -08:00
parent e3ef03ddcd
commit bcc912077d
No known key found for this signature in database
3 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
internal/handlers/admin/routes.go
View File

@ -29,6 +29,7 @@ func NewRouter(deps Dependencies) *gin.Engine {
r.Use(middleware.RequestID) r.Use(middleware.RequestID)
r.Use(middleware.Logging) r.Use(middleware.Logging)
r.Use(middleware.Recovery) r.Use(middleware.Recovery)
r.Use(middleware.SecurityHeaders(strings.HasPrefix(deps.Config.BaseURL, "https")))
tsAuth := &TailscaleAuth{allowedUsers: deps.Config.TailscaleAllowedUsers} tsAuth := &TailscaleAuth{allowedUsers: deps.Config.TailscaleAllowedUsers}
r.Use(tsAuth.Middleware) r.Use(tsAuth.Middleware)

1
internal/handlers/public/routes.go
View File

@ -31,6 +31,7 @@ func NewRouter(deps Dependencies) *gin.Engine {
r.Use(middleware.RequestID) r.Use(middleware.RequestID)
r.Use(middleware.Logging) r.Use(middleware.Logging)
r.Use(middleware.Recovery) r.Use(middleware.Recovery)
r.Use(middleware.SecurityHeaders(strings.HasPrefix(deps.Config.BaseURL, "https")))
r.Use(deps.Auth.SessionMiddleware) r.Use(deps.Auth.SessionMiddleware)
csrfSecret := []byte(deps.Config.SessionSecret) csrfSecret := []byte(deps.Config.SessionSecret)

12
internal/middleware/middleware.go
View File

@ -44,3 +44,15 @@ func Recovery(c *gin.Context) {
}() }()
c.Next() c.Next()
} }
func SecurityHeaders(secure bool) gin.HandlerFunc {
return func(c *gin.Context) {
c.Header("X-Content-Type-Options", "nosniff")
c.Header("X-Frame-Options", "DENY")
c.Header("Referrer-Policy", "strict-origin-when-cross-origin")
if secure {
c.Header("Strict-Transport-Security", "max-age=63072000; includeSubDomains")
}
c.Next()
}
}