Add missing security headers (X-Content-Type-Options, X-Frame-Options, CSP, Referrer-Policy, Permissions-Policy)

api/app_factory.py

@@ -44,12 +44,37 @@ async def dispatch(self, request: Request, call_next):
 
         response = await call_next(request)
 
-        # Add HSTS header to prevent man-in-the-middle attacks
-        # max-age=31536000: 1 year in seconds
-        # includeSubDomains: apply to all subdomains
-        # preload: eligible for browser HSTS preload lists
-        hsts_value = "max-age=31536000; includeSubDomains; preload"
-        response.headers["Strict-Transport-Security"] = hsts_value
+        # HSTS: prevent man-in-the-middle attacks
+        response.headers["Strict-Transport-Security"] = (
+            "max-age=31536000; includeSubDomains; preload"
+        )
+
+        # Prevent MIME-sniffing attacks
+        response.headers["X-Content-Type-Options"] = "nosniff"
+
+        # Prevent clickjacking
+        response.headers["X-Frame-Options"] = "DENY"
+
+        # XSS mitigation via Content Security Policy
+        response.headers["Content-Security-Policy"] = (
+            "default-src 'self'; "
+            "script-src 'self'; "
+            "style-src 'self' 'unsafe-inline'; "
+            "img-src 'self' data:; "
+            "font-src 'self'; "
+            "connect-src 'self'; "
+            "frame-ancestors 'none'; "
+            "object-src 'none'; "
+            "base-uri 'self'"
+        )
+
+        # Prevent referrer data leaks to third parties
+        response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
+
+        # Restrict browser features
+        response.headers["Permissions-Policy"] = (
+            "camera=(), microphone=(), geolocation=(), payment=()"
+        )
 
         return response
 

tests/test_hsts_header.py

@@ -1,13 +1,13 @@
 """
-Test for HSTS header presence in responses.
+Test for security header presence in responses.
 """
 import pytest
 from fastapi.testclient import TestClient
 from api.index import app
 
 
-class TestHSTSHeader:
-    """Test HSTS security header."""
+class TestSecurityHeaders:
+    """Test security headers."""
 
     @pytest.fixture
     def client(self):
@@ -16,28 +16,63 @@ def client(self):
 
     def test_hsts_header_present(self, client):
         """Test that the HSTS header is present in responses."""
-        # Make a request to the root endpoint
         response = client.get("/")
 
-        # Verify HSTS header is present
         assert "strict-transport-security" in response.headers
-
-        # Verify header value contains required directives
         hsts_header = response.headers["strict-transport-security"]
         assert "max-age=31536000" in hsts_header
         assert "includeSubDomains" in hsts_header
         assert "preload" in hsts_header
 
     def test_hsts_header_on_api_endpoints(self, client):
         """Test that the HSTS header is present on API endpoints."""
-        # Test on graphs endpoint
         response = client.get("/graphs")
 
-        # Verify HSTS header is present
         assert "strict-transport-security" in response.headers
-
-        # Verify header value contains required directives
         hsts_header = response.headers["strict-transport-security"]
         assert "max-age=31536000" in hsts_header
         assert "includeSubDomains" in hsts_header
         assert "preload" in hsts_header
+
+    def test_x_content_type_options(self, client):
+        """Test that X-Content-Type-Options is set to nosniff."""
+        response = client.get("/")
+        assert response.headers.get("x-content-type-options") == "nosniff"
+
+    def test_x_frame_options(self, client):
+        """Test that X-Frame-Options is set to DENY."""
+        response = client.get("/")
+        assert response.headers.get("x-frame-options") == "DENY"
+
+    def test_content_security_policy(self, client):
+        """Test that Content-Security-Policy header is present."""
+        response = client.get("/")
+        csp = response.headers.get("content-security-policy")
+        assert csp is not None
+        assert "default-src 'self'" in csp
+        assert "script-src 'self'" in csp
+        assert "frame-ancestors 'none'" in csp
+        assert "object-src 'none'" in csp
+
+    def test_referrer_policy(self, client):
+        """Test that Referrer-Policy header is present."""
+        response = client.get("/")
+        assert response.headers.get("referrer-policy") == "strict-origin-when-cross-origin"
+
+    def test_permissions_policy(self, client):
+        """Test that Permissions-Policy header is present."""
+        response = client.get("/")
+        policy = response.headers.get("permissions-policy")
+        assert policy is not None
+        assert "camera=()" in policy
+        assert "microphone=()" in policy
+        assert "geolocation=()" in policy
+
+    def test_security_headers_on_api_endpoints(self, client):
+        """Test that all security headers are present on API endpoints."""
+        response = client.get("/graphs")
+        assert "x-content-type-options" in response.headers
+        assert "x-frame-options" in response.headers
+        assert "content-security-policy" in response.headers
+        assert "referrer-policy" in response.headers
+        assert "permissions-policy" in response.headers