c262e89e8f
Add security headers to all gateway responses: - X-Frame-Options: DENY - X-Content-Type-Options: nosniff - Strict-Transport-Security: max-age=31536000; includeSubDomains - Referrer-Policy: strict-origin-when-cross-origin - Content-Security-Policy: default-src 'self' Uses tower_http::set_header::SetResponseHeaderLayer applied globally. Closes CRITICAL SECURITY GAP #2 from security review.
15 lines
431 B
TOML
15 lines
431 B
TOML
[package]
|
|
name = "gateway"
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
|
|
[dependencies]
|
|
axum = { workspace = true }
|
|
tokio = { workspace = true }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
tower-http = { version = "0.6", features = ["cors", "set-header"] }
|
|
tracing = { workspace = true }
|
|
tracing-subscriber = { workspace = true }
|
|
reqwest = { version = "0.12", features = ["json", "stream"] }
|
|
anyhow = { workspace = true }
|