sneak 911dfbb825 feat(backend): server hardening — timeouts, security headers, trusted-proxy client IP (closes #19) ...

Add ReadHeaderTimeout and IdleTimeout to the http.Server (named
constants beside the existing timeouts) to close the slowloris and
idle-keep-alive gaps.

Add a SecurityHeaders middleware setting HSTS, a JSON-API CSP
(default-src 'none'; frame-ancestors 'none'), X-Frame-Options: DENY,
X-Content-Type-Options: nosniff, Referrer-Policy, and Permissions-Policy.
It is registered before CORS so the headers ride on preflight responses.

Resolve the client IP from X-Forwarded-For / X-Real-IP only when the
direct peer is in a trusted-proxy allowlist, defaulting to loopback plus
RFC1918 and configurable via TRUSTED_PROXIES; an untrusted peer's
forwarded headers are ignored and the direct peer is logged. Uses
net/netip; no new dependency.

Model: opus-4-8

2026-09-21 12:49:58 +00:00

..

http.go

feat(backend): server hardening — timeouts, security headers, trusted-proxy client IP (closes #19)

2026-09-21 12:49:58 +00:00

routes.go

feat(backend): server hardening — timeouts, security headers, trusted-proxy client IP (closes #19)

2026-09-21 12:49:58 +00:00

server.go

Add backend with buffered zstd-compressed report storage

2026-02-27 12:14:34 +07:00