LinYushen e20c507dcc fix(security): add Content-Security-Policy response header (#822) ...

Adds CSP middleware to the global middleware chain as a browser-level
defense against XSS: script-src 'self', object-src 'none',
frame-ancestors 'none', base-uri 'self', form-action 'self'.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-13 12:53:39 +08:00

..

auth_test.go

feat(auth): migrate auth token to HttpOnly Cookie & WebSocket Origin whitelist (#819)

2026-04-13 12:13:35 +08:00

auth.go

feat(auth): migrate auth token to HttpOnly Cookie & WebSocket Origin whitelist (#819)

2026-04-13 12:13:35 +08:00

cloudfront.go

fix(auth): extend JWT and CloudFront cookie expiration from 72h to 30 days

2026-04-06 21:48:31 +08:00

csp_test.go

fix(security): add Content-Security-Policy response header (#822)

2026-04-13 12:53:39 +08:00

csp.go

fix(security): add Content-Security-Policy response header (#822)

2026-04-13 12:53:39 +08:00

daemon_auth.go

fix(security): add workspace ownership checks to daemon API routes (#684)

2026-04-11 12:49:23 +08:00

request_logger.go

feat(logging): add structured logging across server and SDK

2026-03-26 10:57:11 +08:00

workspace.go

refactor(server): consolidate workspace permission checks into middleware

2026-03-30 03:40:20 +08:00