Skip to content

m8.5: HTTP-surface hardening

Choose a tag to compare

View all tags
@WilliamSmithEdwardSandbox WilliamSmithEdwardSandbox released this 15 Jun 05:15
m8.5
c5952fc

Adds routine HTTP-surface defenses from the security audit (ADR-0018), dependency-free and applied to every route. Backward compatible.

What's new

  • Security response headers on every response: X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: no-referrer, Strict-Transport-Security (honored once TLS is fronted, harmless over HTTP), and a same-origin Content-Security-Policy. The CSP fits the bundled single-page UI (it loads its own script bundle and talks only to this origin, including the WebSocket) and is a constant operators can relax if they front the app differently.
  • Explicit request body-size limit (8 MiB): the per-request body bound is now intentional and documented (axum defaulted to 2 MiB), generous enough for batch writes and flow imports; an over-limit request is rejected with 413 before the handler runs.

A per-request timeout is intentionally deferred: a global timeout would cut off legitimately long synchronous flow runs and needs route-scoping, so it is a later slice rather than bundled with these zero-risk changes. TLS remains its own decision (it needs a dependency or a fronting proxy); the HSTS header is correct in advance of it.

Covered by tests/http_hardening.rs. Remaining hardening-bundle items (session idle-timeout and revocation, password policy, login dummy-hash, parser and input-size bounds) are follow-on slices.

Assets 6
Loading