Lukas
400ab1a3f1
- Add SecurityHeadersMiddleware to backend/app/main.py - Implements Content-Security-Policy: default-src 'self' - Implements X-Frame-Options: DENY (clickjacking protection) - Implements X-Content-Type-Options: nosniff (MIME-sniffing protection) - Implements X-XSS-Protection: 1; mode=block (browser XSS filters) - Add CSP meta tag to frontend/index.html for defense-in-depth - Create Docs/Security.md with comprehensive security headers documentation - Add test suite (backend/tests/test_security_headers_middleware.py) with 5 tests - Tests verify headers are present on success and error responses - Tests ensure all four security headers are correctly set - All existing tests continue to pass Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
19 lines
665 B
HTML
19 lines
665 B
HTML
<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
|
<meta http-equiv="Content-Security-Policy" content="default-src 'self'" />
|
|
<meta name="description" content="BanGUI — fail2ban management interface." />
|
|
<meta name="theme-color" content="#0F6CBD" />
|
|
<meta name="robots" content="noindex, nofollow" />
|
|
<link rel="icon" href="/favicon.ico" />
|
|
<title>BanGUI</title>
|
|
</head>
|
|
<body>
|
|
<noscript>BanGUI requires JavaScript to run.</noscript>
|
|
<div id="root"></div>
|
|
<script type="module" src="/src/main.tsx"></script>
|
|
</body>
|
|
</html>
|