stacklok / toolhive / 27023988877

66%

Build Type

push

github

Committed by web-flow

Commit Message

fix(api): add X-Content-Type-Options and Cross-Origin-Resource-Policy headers (#5458)

* fix(api): add X-Content-Type-Options and Cross-Origin-Resource-Policy headers

Adds two security response headers to every HTTP response via the existing
headersMiddleware function in BuildRouter:

- X-Content-Type-Options: nosniff — prevents browsers from MIME-sniffing
  the content type of responses
- Cross-Origin-Resource-Policy: same-origin — guards against Spectre-style
  cross-origin resource inclusion attacks

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* test(api): assert security headers present on every response

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Coverage Stats

2 of 2 new or added lines in 1 file covered. (100.0%)

11 existing lines in 3 files now uncovered.

66722 of 100872 relevant lines covered (66.15%)

63.76 hits per line