fix(security): add strict security headers to HTML error responses

[jonasiu]

Summary

Implements strict security headers on HTML error responses (404 and 500) to address issue #100. This provides defense-in-depth protection even though the application currently returns JSON-only responses.

Changes

Code Changes

• 404 Handler (apps/backend/src/index.ts): Added strict security headers before JSON response
• Error Handler (apps/backend/src/middlewares/errorHandler.ts): Created setStrictSecurityHeaders() helper and applied to all error responses

Security Headers Enforced

✅ Content-Security-Policy: default-src 'none'; script-src 'none'; style-src 'none'; img-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'

• Blocks ALL resources (stricter than Helmet defaults)

✅ X-Content-Type-Options: nosniff

• Prevents MIME type sniffing

✅ X-Frame-Options: DENY

• Prevents clickjacking attacks

✅ Content-Disposition: inline

• Prevents download misinterpretation

Test Coverage

• 4 new unit tests for 404 handler security headers
• 3 new unit tests for error handler security headers
• New integration test file with 8 comprehensive tests using supertest
• All 893 backend tests pass ✅

Manual Verification

# Test 404 with XSS payload
curl -I "http://localhost:3001/%3Cscript%3Ealert(1)%3C/script%3E"

# Response includes all security headers:
Content-Security-Policy: default-src 'none'; script-src 'none'; ...
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Disposition: inline
Content-Type: application/json

Testing

Run tests:

pnpm test:backend  # All 893 tests pass
pnpm lint          # No errors (only pre-existing warnings)
pnpm build         # Successful

Impact

• Risk: LOW - Non-breaking change (adds headers to existing JSON responses)
• Benefit: HIGH - Defense-in-depth security posture
• Performance: Negligible (4 header operations per error response)

Closes

Closes #100

---

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud