3 commits

Author	SHA1	Message	Date
senke	9a0cb21ff2	fix: Allow Swagger UI to be embedded in iframe ... - Modify SecurityHeaders middleware to detect Swagger routes - Set X-Frame-Options to SAMEORIGIN for Swagger routes (instead of DENY) - Update CSP to allow embedding (frame-ancestors 'self') for Swagger routes - Relax Cross-Origin policies for Swagger routes to enable iframe embedding - Allow necessary resources (scripts, styles, images) for Swagger UI - Fixes Content-Security-Policy frame-ancestors violation blocking Swagger documentation	2026-01-18 14:06:41 +01:00
senke	bddde37f73	[BE-SEC-011] be-sec: Implement security headers ... - Enhanced security headers middleware with additional headers - Added X-Permitted-Cross-Domain-Policies: none - Added Cross-Origin-Embedder-Policy: require-corp - Added Cross-Origin-Opener-Policy: same-origin - Added Cross-Origin-Resource-Policy: same-origin - Enhanced Permissions-Policy with additional restrictions - Enhanced CSP with frame-ancestors directive - HSTS now only set in production (not in development) - Updated tests to verify all new headers	2025-12-24 12:24:54 +01:00
senke	d33c351ac6	refonte: backend-api go first; phase 1	2025-12-12 21:34:34 -05:00