Security Headers Implementation

🛡️ Overview

The security headers middleware provides comprehensive HTTP security headers to protect against common web vulnerabilities while maintaining optimal functionality for both administrative interfaces and proxy operations.

🏗️ Architecture

Two-Tier Security Model

Administrative Endpoints

🔐 Content Security Policy

default-src 'self';
script-src 'self' 'unsafe-inline' 'unsafe-eval';
style-src 'self' 'unsafe-inline';
img-src 'self' data: https:;
connect-src 'self' wss: ws:;
frame-ancestors 'none';
base-uri 'self'

default-src 'self' *.microsoft.com *.microsoftonline.com *.live.com;
script-src 'self' 'unsafe-inline' 'unsafe-eval' *.microsoft.com *.microsoftonline.com;
style-src 'self' 'unsafe-inline' *.microsoft.com *.microsoftonline.com;
img-src 'self' data: https: *.microsoft.com *.microsoftonline.com;
connect-src 'self' wss: ws: *.microsoft.com *.microsoftonline.com;
frame-ancestors 'self';
base-uri 'self'

🛡️ Security Headers

🌐 CORS Configuration

⚙️ Implementation Details

Middleware Integration

// Applied to all requests via middleware wrapper
secureMux := http.NewServeMux()
secureMux.Handle("/", utils.SecurityHeaders(mux))

Endpoint Classification

func isAdminEndpoint(path string) bool {
    adminPaths := []string{"/admin/", "/ws", "/logs/", "/api/admin/", 
                           "/fleet/", "/vps/", "/api/metrics/", "/api/security/"}
    // Path prefix matching logic
}

CORS Preflight Handling

if r.Method == "OPTIONS" {
    w.WriteHeader(http.StatusOK)
    return
}

🎯 Security Benefits

🔧 Troubleshooting

Header Verification

curl -I https://your-domain.com/admin/