🛡️ Sentinel: [security improvement] Add API security headers

apps/api/src/cortex_api/middleware/request_context.py

@@ -40,4 +40,9 @@ async def request_context_middleware(
         response.headers[X_REQUEST_ID_HEADER] = request_id
         if trace_context["trace_id"]:
             response.headers[X_TRACE_ID_HEADER] = str(trace_context["trace_id"])
+
+        response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
+        response.headers["X-Content-Type-Options"] = "nosniff"
+        response.headers["X-Frame-Options"] = "DENY"
+
         return response

tests/unit/test_api_middleware.py

@@ -0,0 +1,24 @@
+import pytest
+from cortex_api.middleware.request_context import request_context_middleware
+from fastapi import Request, Response
+
+
+@pytest.mark.asyncio
+async def test_request_context_middleware_adds_security_headers():
+    request = Request({
+        "type": "http",
+        "state": {},
+        "headers": [],
+        "method": "GET",
+        "path": "/"
+    })
+
+    async def call_next(req: Request) -> Response:
+        return Response(content="ok")
+
+    response = await request_context_middleware(request, call_next)
+
+    hsts = response.headers.get("Strict-Transport-Security")
+    assert hsts == "max-age=31536000; includeSubDomains"
+    assert response.headers.get("X-Content-Type-Options") == "nosniff"
+    assert response.headers.get("X-Frame-Options") == "DENY"