feat(saas): enforce strict response policy

req: security/006

req: operations/006

req: operations/008

examples/saas/src/lib.rs

@@ -619,7 +619,7 @@ mod tests {
 
     #[test]
     fn mutation_diagnostics_are_structured_and_cannot_carry_request_secrets() {
-        // req: operations/003 req: operations/005 req: security/008
+        // req: operations/003 req: operations/005
         let diagnostics = Arc::new(RecordingDiagnostics::default());
         let ctx = AppContext::demo().with_diagnostic_sink(diagnostics.clone());
         let request_id = ctx.next_request_id();

examples/saas/src/main.rs

@@ -1,6 +1,7 @@
 use axum::body::Body;
-use axum::extract::{DefaultBodyLimit, Form, Query, State};
+use axum::extract::{DefaultBodyLimit, Form, Query, Request, State};
 use axum::http::{HeaderMap, HeaderValue, StatusCode};
+use axum::middleware::{self, Next};
 use axum::response::{IntoResponse, Response};
 use axum::routing::{get, post};
 use axum::Router;
@@ -38,9 +39,29 @@ fn app(ctx: AppContext) -> Router {
         .route("/app.css", get(css))
         .route("/metrics.js", get(metrics_js))
         .layer(DefaultBodyLimit::max(8 * 1024))
+        .layer(middleware::from_fn(security_headers))
         .with_state(ctx)
 }
 
+// req: security/006 req: security/009
+async fn security_headers(request: Request, next: Next) -> Response {
+    let mut response = next.run(request).await;
+    let headers = response.headers_mut();
+    headers.insert(
+        "content-security-policy",
+        HeaderValue::from_static("default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'"),
+    );
+    headers.insert(
+        "x-content-type-options",
+        HeaderValue::from_static("nosniff"),
+    );
+    headers.insert(
+        "referrer-policy",
+        HeaderValue::from_static("strict-origin-when-cross-origin"),
+    );
+    response
+}
+
 async fn home(State(ctx): State<AppContext>) -> impl IntoResponse {
     axum::response::Html(home_page(&ctx).into_string())
 }