security: add HTTP resource limits and browser security headers #358

New issue

Closed

opened 2026-07-16 21:03:42 +02:00 by dries · 0 comments

dries commented

2026-07-16 21:03:42 +02:00

Owner

What to build

Harden the HTTP server against slow-connection exhaustion and reduce browser attack surface with response headers compatible with the SPA, event streams, and in-app terminal.

Acceptance criteria

The server sets bounded header-read and idle timeouts without breaking long-lived SSE or WebSocket connections.
Responses include a tested Content Security Policy suitable for the production SPA.
Responses prevent framing and MIME sniffing and define a conservative referrer policy.
Development proxying, static assets, API calls, SSE, WebSockets, and terminal rendering remain functional.
Tests verify timeout configuration and security headers on representative routes.
Configuration documentation records any intentional CSP exceptions.

Blocked by

None - can start immediately.

## What to build Harden the HTTP server against slow-connection exhaustion and reduce browser attack surface with response headers compatible with the SPA, event streams, and in-app terminal. ## Acceptance criteria - [ ] The server sets bounded header-read and idle timeouts without breaking long-lived SSE or WebSocket connections. - [ ] Responses include a tested Content Security Policy suitable for the production SPA. - [ ] Responses prevent framing and MIME sniffing and define a conservative referrer policy. - [ ] Development proxying, static assets, API calls, SSE, WebSockets, and terminal rendering remain functional. - [ ] Tests verify timeout configuration and security headers on representative routes. - [ ] Configuration documentation records any intentional CSP exceptions. ## Blocked by None - can start immediately.