From 5f214cb3e0787e52b8845fce60031e928f978fe4 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Tue, 28 Jul 2026 20:02:20 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[security?=
 =?UTF-8?q?=20improvement]=20Add=20standard=20API=20security=20headers?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds `Strict-Transport-Security`, `X-Content-Type-Options`, and `X-Frame-Options` headers to all API responses via the request context middleware to improve security posture and prevent common vulnerabilities like clickjacking and MIME-type sniffing. Includes unit test verification.

Co-authored-by: crabcanon <3458947+crabcanon@users.noreply.github.com>
---
 .../cortex_api/middleware/request_context.py  |  5 ++++
 tests/unit/test_api_middleware.py             | 24 +++++++++++++++++++
 2 files changed, 29 insertions(+)
 create mode 100644 tests/unit/test_api_middleware.py

diff --git a/apps/api/src/cortex_api/middleware/request_context.py b/apps/api/src/cortex_api/middleware/request_context.py
index 06a56bd..61a32e3 100644
--- a/apps/api/src/cortex_api/middleware/request_context.py
+++ b/apps/api/src/cortex_api/middleware/request_context.py
@@ -40,4 +40,9 @@ async def request_context_middleware(
         response.headers[X_REQUEST_ID_HEADER] = request_id
         if trace_context["trace_id"]:
             response.headers[X_TRACE_ID_HEADER] = str(trace_context["trace_id"])
+
+        response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
+        response.headers["X-Content-Type-Options"] = "nosniff"
+        response.headers["X-Frame-Options"] = "DENY"
+
         return response
diff --git a/tests/unit/test_api_middleware.py b/tests/unit/test_api_middleware.py
new file mode 100644
index 0000000..d43734c
--- /dev/null
+++ b/tests/unit/test_api_middleware.py
@@ -0,0 +1,24 @@
+import pytest
+from cortex_api.middleware.request_context import request_context_middleware
+from fastapi import Request, Response
+
+
+@pytest.mark.asyncio
+async def test_request_context_middleware_adds_security_headers():
+    request = Request({
+        "type": "http",
+        "state": {},
+        "headers": [],
+        "method": "GET",
+        "path": "/"
+    })
+
+    async def call_next(req: Request) -> Response:
+        return Response(content="ok")
+
+    response = await request_context_middleware(request, call_next)
+
+    hsts = response.headers.get("Strict-Transport-Security")
+    assert hsts == "max-age=31536000; includeSubDomains"
+    assert response.headers.get("X-Content-Type-Options") == "nosniff"
+    assert response.headers.get("X-Frame-Options") == "DENY"
\ No newline at end of file