From 71b11e2f94b30414eecb329aba6a0f833e54a40f Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Thu, 23 Jul 2026 20:03:22 +0000 Subject: [PATCH] Add basic API security headers to global middleware Co-authored-by: crabcanon <3458947+crabcanon@users.noreply.github.com> --- .jules/sentinel.md | 4 ++++ apps/api/src/cortex_api/middleware/request_context.py | 6 ++++++ 2 files changed, 10 insertions(+) create mode 100644 .jules/sentinel.md diff --git a/.jules/sentinel.md b/.jules/sentinel.md new file mode 100644 index 0000000..83e98a2 --- /dev/null +++ b/.jules/sentinel.md @@ -0,0 +1,4 @@ +## 2025-02-12 - Missing Security Headers in Global Middleware +**Vulnerability:** The API responses lacked basic security headers like Strict-Transport-Security (HSTS), X-Frame-Options, and X-Content-Type-Options. +**Learning:** These headers are crucial for basic web application security, even for APIs, and should be added globally at the middleware layer. Overly restrictive CSP should be avoided for API services to maintain documentation availability. +**Prevention:** Always include a foundational set of security headers for HTTP responses in FastAPI middleware during initial setup. diff --git a/apps/api/src/cortex_api/middleware/request_context.py b/apps/api/src/cortex_api/middleware/request_context.py index 06a56bd..2889e21 100644 --- a/apps/api/src/cortex_api/middleware/request_context.py +++ b/apps/api/src/cortex_api/middleware/request_context.py @@ -40,4 +40,10 @@ async def request_context_middleware( response.headers[X_REQUEST_ID_HEADER] = request_id if trace_context["trace_id"]: response.headers[X_TRACE_ID_HEADER] = str(trace_context["trace_id"]) + + # Add basic API security headers + response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains" + response.headers["X-Frame-Options"] = "DENY" + response.headers["X-Content-Type-Options"] = "nosniff" + return response