fix(commerce): harden demo server for public deployment

[mohamedmansour]

Security audit identified 7 findings; all are now resolved to make the demo site safer:

1. Security headers — Add DefaultHeaders middleware with CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy on every response (security.rs).

2. Cache-Control / Vary — Set 'Cache-Control: private, no-store' and 'Vary: Accept, Cookie' on all dynamic HTML and JSON responses to prevent CDN/proxy cache poisoning of personalized content.

3. CSRF protection — Validate Origin (or Referer) header on /cart/add and /cart/update POST endpoints. Rejects cross-origin requests with 403 while allowing same-origin form submissions and test harnesses that omit both headers (OWASP double-submit approach).

4. Rate limiting — Add in-memory IP-based fixed-window rate limiter (60 req/IP/min) stored in AppState. Applied to cart mutation endpoints. Returns 429 when exceeded. Fails open on missing peer IP. Expired entries pruned opportunistically.

5. Open redirect hardening — Reject backslashes, control characters (< 0x20), and DEL (0x7f) in sanitize_redirect() to close browser-dependent redirect edge cases.

6. HMAC cookie signing — Sign cart cookie with HMAC-SHA256 (hmac + sha2 crates). Cookie format is now '<hex_payload>.<hex_sig>'. Unsigned or tampered cookies are rejected and cart is reset.

7. Static asset cache headers — Add 'Cache-Control: public, max-age=86400' to CSS and asset responses in serve_asset().

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Hardens the commerce demo server for safer public deployment by adding standard security headers, preventing caching of personalized responses, adding CSRF checks and rate limiting on cart mutations, and signing cart cookies to prevent tampering.

Changes:

• Add security middleware (CSP + related headers), CSRF origin/referer validation, and IP-based rate limiting for cart mutation endpoints.
• Add cache headers for dynamic responses and static assets; tighten redirect sanitization.
• Sign cart cookies with HMAC-SHA256 and add an audit writeup documenting findings/resolutions.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
examples/app/commerce/server/src/server.rs	Adds CSRF + rate-limit checks to cart mutations; adds Cache-Control/Vary to dynamic JSON/HTML responses.
examples/app/commerce/server/src/security.rs	Introduces security headers middleware and CSRF validation helpers + tests.
examples/app/commerce/server/src/rate_limit.rs	Adds in-memory fixed-window IP rate limiter + tests.
examples/app/commerce/server/src/main.rs	Wires security headers middleware and new modules into the server.
examples/app/commerce/server/src/frontend.rs	Adds Cache-Control for CSS and other static asset responses.
examples/app/commerce/server/src/error.rs	Adds CsrfRejected (403) and RateLimited (429) error variants.
examples/app/commerce/server/src/cart.rs	Adds redirect hardening and HMAC-signed cart cookie format + tests.
examples/app/commerce/server/src/app.rs	Stores RateLimiter in AppState and exposes accessor.
examples/app/commerce/server/Cargo.toml	Adds hmac/sha2 deps (workspace) for cookie signing.
examples/app/commerce/EXPLOIT.md	Adds security audit report describing the findings and fixes.
Cargo.toml	Adds a new workspace member and workspace deps for hmac/sha2.