feat(backend): server hardening: timeouts, security headers, trusted-proxy client IP (closes #19)

Add ReadHeaderTimeout and IdleTimeout to the http.Server as named constants beside the existing timeouts. Add a SecurityHeaders middleware (HSTS, a JSON-API CSP of default-src 'none'; frame-ancestors 'none', X-Frame-Options DENY, nosniff, Referrer-Policy, Permissions-Policy), registered before CORS so preflight responses carry it. Resolve the client IP from X-Forwarded-For / X-Real-IP only when the direct peer is in the trusted-proxy allowlist (loopback plus RFC1918 by default, configurable via TRUSTED_PROXIES); an untrusted peer's forwarded headers are ignored. Uses net/netip; no new dependency. Model: opus-4-8 (implementation and review); claude-fable-5 (merge)
2026-09-21 15:05:25 +02:00
parent f7c7f92e27
commit f3895789d2
8 changed files with 347 additions and 16 deletions
@@ -22,6 +22,11 @@ files, so merging it also closes most compliance gaps.

 # Completed Steps

+- 2026-09-21: backend HTTP hardening (issue #19): added `ReadHeaderTimeout` and
+  `IdleTimeout` to the server, a `SecurityHeaders` middleware (HSTS, tight CSP,
+  frame/sniff/referrer/permissions headers) registered before CORS, and
+  trusted-proxy client IP resolution honouring `X-Forwarded-For` / `X-Real-IP`
+  only from a `TRUSTED_PROXIES` allowlist (loopback plus RFC1918 by default)
 - 2026-08-10: every interactive control now meets the 44x44 CSS px minimum tap
  target (`.pin-btn`, `#interval-select`, the debug-log label and, on narrow
  viewports, `#pause-btn`). The pin button's hit area grows via matching