From 6aca5eb559fe1bf2de24cb8663930e839754af37 Mon Sep 17 00:00:00 2001 From: Jon Saad-Falcon <41205309+jonsaadfalcon@users.noreply.github.com> Date: Sat, 28 Mar 2026 21:27:38 -0700 Subject: [PATCH] feat: add Content-Security-Policy header to API responses Co-Authored-By: Claude Sonnet 4.6 --- src/openjarvis/server/middleware.py | 2 ++ tests/server/test_middleware.py | 1 + 2 files changed, 3 insertions(+) diff --git a/src/openjarvis/server/middleware.py b/src/openjarvis/server/middleware.py index 0d22ecb0..b31b7915 100644 --- a/src/openjarvis/server/middleware.py +++ b/src/openjarvis/server/middleware.py @@ -48,6 +48,7 @@ def create_security_middleware() -> Any: response.headers["Permissions-Policy"] = ( "camera=(), microphone=(), geolocation=()" ) + response.headers["Content-Security-Policy"] = "default-src 'self'" return response return SecurityHeadersMiddleware @@ -61,4 +62,5 @@ SECURITY_HEADERS = { "Strict-Transport-Security": "max-age=31536000; includeSubDomains", "Referrer-Policy": "strict-origin-when-cross-origin", "Permissions-Policy": "camera=(), microphone=(), geolocation=()", + "Content-Security-Policy": "default-src 'self'", } diff --git a/tests/server/test_middleware.py b/tests/server/test_middleware.py index d2016082..451cc973 100644 --- a/tests/server/test_middleware.py +++ b/tests/server/test_middleware.py @@ -19,6 +19,7 @@ class TestSecurityHeaders: "Strict-Transport-Security", "Referrer-Policy", "Permissions-Policy", + "Content-Security-Policy", } assert set(SECURITY_HEADERS.keys()) == expected_keys