Security checks and hardening #231

Merged

aaperis merged 12 commits from 169-security-checks-and-hardening into develop

2026-09-23 13:20:35 +00:00

aaperis commented

2026-09-22 20:15:29 +00:00

(Migrated from github.com)

This PR closes #169 .

It applies a set of security improvements identified through a scan-driven review of the app in local and demo deployed environments of the production image.

Type of change

New feature (non-breaking change which adds functionality)

List of changes made

Response headers

Added the following security headers to all responses via next.config.ts's headers():

X-Content-Type-Options: nosniff — instructs browsers to trust declared Content-Type values instead of guessing from body content.
Referrer-Policy: same-origin — prevents internal URLs from leaking to external sites via the Referer header on outbound links.
Strict-Transport-Security: max-age=31536000; includeSubDomains — HTTPS-only enforcement for one year. Applied unconditionally; browsers ignore HSTS on localhost, so local dev is unaffected.

Suppressed the framework identification header:

X-Powered-By removed via poweredByHeader: false in next.config.ts.

Content Security Policy

Added a proxy layer (proxy.ts) that emits a strict CSP with a per-request nonce on rendered pages.

Testing

Changes deployed to the demo site.

Verify that all functionality works as before.
Check that headers contain the additions from this PR.
Copy paste the demo site url in Webbkoll.

Verification

Security headers were also verified via curl and active and passive scans with ZAP.
Third-party header scanners (Webbkoll, CSP Evaluator) PASS and show only the documented (see comments in proxy.ts) accepted flags remaining.

Definition of Done checklist

I have made an effort making the commit history understandable
I have performed a self-review of my own code and commented any hard-to-understand areas
Existing tests are passing and I wrote unit tests for new functionality
My changes generate no new warnings
All Acceptance Criteria (AC) Fulfilled and checked in the Related issue
Documentation Updated (if applicable):
- Considerations: in-code comments.

## Related issue(s) and PR(s) This PR closes #169 . It applies a set of security improvements identified through a scan-driven review of the app in local and demo deployed environments of the production image. ## Type of change - [x] New feature (non-breaking change which adds functionality) ## List of changes made ### Response headers Added the following security headers to all responses via `next.config.ts`'s `headers()`: - **`X-Content-Type-Options: nosniff`** — instructs browsers to trust declared `Content-Type` values instead of guessing from body content. - **`Referrer-Policy: same-origin`** — prevents internal URLs from leaking to external sites via the `Referer` header on outbound links. - **`Strict-Transport-Security: max-age=31536000; includeSubDomains`** — HTTPS-only enforcement for one year. Applied unconditionally; browsers ignore HSTS on localhost, so local dev is unaffected. Suppressed the framework identification header: - **`X-Powered-By`** removed via `poweredByHeader: false` in `next.config.ts`. Content Security Policy - Added a proxy layer (`proxy.ts`) that emits a strict CSP with a per-request nonce on rendered pages. ## Testing Changes deployed to the demo site. - Verify that all functionality works as before. - Check that headers contain the additions from this PR. - Copy paste the demo site url in Webbkoll. ### Verification - Security headers were also verified via `curl` and active and passive scans with ZAP. - Third-party header scanners (Webbkoll, CSP Evaluator) PASS and show only the documented (see comments in `proxy.ts`) accepted flags remaining. ## Definition of Done checklist - [x] I have made an effort making the commit history understandable - [x] I have performed a self-review of my own code and commented any hard-to-understand areas - [x] Existing tests are passing and I wrote unit tests for new functionality - [x] My changes generate no new warnings - [x] All Acceptance Criteria (AC) Fulfilled and checked in the Related issue - [x] **Documentation Updated (if applicable):** - Considerations: in-code comments.