sneak 3afce48383 feat: add HSTS, CSP, and Permissions-Policy security headers (closes #91) ...

SecurityHeaders() now also sets Strict-Transport-Security,
Content-Security-Policy, and Permissions-Policy.

HSTS is emitted unconditionally: browsers ignore it over plaintext
(RFC 6797 section 8.1), so it never lies about the connection and no
forwarded-proto header need be trusted.

The CSP baseline is default-src 'self' with frame-ancestors 'none' as
the primary clickjacking control. script-src and style-src carry
'unsafe-inline' because the generator template has inline onclick
handlers and the bundled Tailwind asset injects a runtime <style>
element; removing that need is a template change beyond this issue.

Permissions-Policy denies browser features pixa does not use.

Model: opus-4-8

2026-09-21 18:16:20 +00:00

..

middleware_internal_test.go

test: assert HSTS, CSP, and Permissions-Policy headers

2026-09-21 18:16:20 +00:00

middleware.go

feat: add HSTS, CSP, and Permissions-Policy security headers (closes #91)

2026-09-21 18:16:20 +00:00