From 3afce4838349b3ef8eadac8623d83abc2139b9b9 Mon Sep 17 00:00:00 2001
From: sneak <sneak@sneak.berlin>
Date: Mon, 21 Sep 2026 18:16:20 +0000
Subject: [PATCH] feat: add HSTS, CSP, and Permissions-Policy security headers
 (closes #91)

SecurityHeaders() now also sets Strict-Transport-Security,
Content-Security-Policy, and Permissions-Policy.

HSTS is emitted unconditionally: browsers ignore it over plaintext
(RFC 6797 section 8.1), so it never lies about the connection and no
forwarded-proto header need be trusted.

The CSP baseline is default-src 'self' with frame-ancestors 'none' as
the primary clickjacking control. script-src and style-src carry
'unsafe-inline' because the generator template has inline onclick
handlers and the bundled Tailwind asset injects a runtime <style>
element; removing that need is a template change beyond this issue.

Permissions-Policy denies browser features pixa does not use.

Model: opus-4-8
---
 internal/middleware/middleware.go | 37 +++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/internal/middleware/middleware.go b/internal/middleware/middleware.go
index 754ebd1..00d59f7 100644
--- a/internal/middleware/middleware.go
+++ b/internal/middleware/middleware.go
@@ -21,6 +21,33 @@ import (
 // CORSMaxAgeSeconds is the max age for CORS preflight cache (24 hours).
 const CORSMaxAgeSeconds = 86400
 
+// HSTSValue is the Strict-Transport-Security header value: one year with
+// includeSubDomains. Emitted unconditionally even though pixa listens plain
+// HTTP behind a TLS-terminating proxy; browsers ignore an HSTS header received
+// over plaintext (RFC 6797 section 8.1), so it never lies about the connection,
+// and emitting it here avoids trusting a forwarded-proto header.
+const HSTSValue = "max-age=31536000; includeSubDomains"
+
+// ContentSecurityPolicyValue is the Content-Security-Policy header value.
+// default-src 'self' is the baseline and frame-ancestors 'none' is the primary
+// clickjacking control. 'unsafe-inline' is required in script-src and style-src
+// because the served templates carry inline onclick handlers (generator page)
+// and the bundled Tailwind asset injects a runtime <style> element; dropping it
+// needs template changes outside this issue's scope.
+const ContentSecurityPolicyValue = "default-src 'self'; " +
+	"script-src 'self' 'unsafe-inline'; " +
+	"style-src 'self' 'unsafe-inline'; " +
+	"object-src 'none'; " +
+	"base-uri 'self'; " +
+	"form-action 'self'; " +
+	"frame-ancestors 'none'"
+
+// PermissionsPolicyValue is the Permissions-Policy header value. Every listed
+// feature is denied because pixa uses none of them.
+const PermissionsPolicyValue = "accelerometer=(), autoplay=(), camera=(), " +
+	"display-capture=(), geolocation=(), gyroscope=(), magnetometer=(), " +
+	"microphone=(), payment=(), usb=()"
+
 // Params defines dependencies for Middleware.
 type Params struct {
 	fx.In
@@ -164,6 +191,16 @@ func (s *Middleware) SecurityHeaders() func(http.Handler) http.Handler {
 			// Disable XSS filtering (modern browsers don't need it, can cause issues)
 			w.Header().Set("X-XSS-Protection", "0")
 
+			// Force HTTPS on future visits (ignored by browsers over plaintext)
+			w.Header().Set("Strict-Transport-Security", HSTSValue)
+
+			// Restrict content sources; frame-ancestors is the primary
+			// clickjacking control, X-Frame-Options the legacy fallback
+			w.Header().Set("Content-Security-Policy", ContentSecurityPolicyValue)
+
+			// Deny browser features pixa does not use
+			w.Header().Set("Permissions-Policy", PermissionsPolicyValue)
+
 			next.ServeHTTP(w, r)
 		})
 	}