🛡️ Sentinel: [security improvement] Add Security Headers Middleware

app/main.py

@@ -2,7 +2,7 @@
 import os
 import sys
 import uvicorn  # Uvicorn ASGI server for FastAPI
-from fastapi import FastAPI  # FastAPI framework
+from fastapi import FastAPI, Request  # FastAPI framework
 from fastapi.staticfiles import StaticFiles  # To serve static files
 
 # Adding the parent directory of the current script to the system path
@@ -16,7 +16,21 @@
 # Initializing the FastAPI application
 app = FastAPI()
 
+
+@app.middleware("http")
+async def add_security_headers(request: Request, call_next):
+    """
+    Middleware to append security headers to all responses.
+    This helps mitigate risks like MIME sniffing and Clickjacking.
+    """
+    response = await call_next(request)
+    response.headers["X-Content-Type-Options"] = "nosniff"
+    response.headers["X-Frame-Options"] = "DENY"
+    response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
+    return response
+
 # Including the routers for different parts of the application
+
 app.include_router(root.router)       # Root router, handles main endpoints
 app.include_router(extensions.router)  # Extensions router, handles additional features
 app.include_router(builtin.router)     # Builtin router, handles built-in features

pr_description.txt

@@ -0,0 +1,7 @@
+## 🛡️ Sentinel: [security improvement] Add Security Headers Middleware
+
+**🚨 Severity:** MEDIUM
+**💡 Vulnerability:** Missing security headers (MIME sniffing and Clickjacking risks)
+**🎯 Impact:** Without these headers, the application is vulnerable to MIME type confusion attacks and Clickjacking, where an attacker could potentially embed the application in a malicious frame.
+**🔧 Fix:** Added a FastAPI middleware in `app/main.py` that appends `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`, and `Strict-Transport-Security: max-age=31536000; includeSubDomains` to all HTTP responses.
+**✅ Verification:** A new test `test_security_headers` has been added to `test_app.py` to ensure these headers are correctly applied to the responses. The entire test suite was successfully executed using `python3 -m pytest`.

test_app.py

@@ -356,3 +356,11 @@ def test_htmx_headers(client):
     )
     assert response.status_code == 200
     assert b"Correct button was selected based on HTMX Request Headers" in response.content
+
+def test_security_headers(client):
+    """Test that security headers are applied to all responses."""
+    response = client.get("/builtin/info")
+    assert response.status_code == 204
+    assert response.headers.get("X-Content-Type-Options") == "nosniff"
+    assert response.headers.get("X-Frame-Options") == "DENY"
+    assert response.headers.get("Strict-Transport-Security") == "max-age=31536000; includeSubDomains"