Security: No helmet security headers — missing CSP, X-Frame-Options, HSTS

[Siddh2024]

Summary

�pps/public-api/src/app.js sets custom CORS headers but never applies the helmet middleware. The app is missing Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Strict-Transport-Security headers.

Details

• File: �pps/public-api/src/app.js
• Express app without helmet() middleware
• Also: express.json() is used without a limit option — no body size cap
• Also: CORS configuration may be overly permissive for some endpoints

Impact

Missing security headers expose the app to clickjacking (no X-Frame-Options), MIME-type sniffing, and attacks that rely on missing CSP. Unlimited JSON body size enables memory-exhaustion DoS.

Suggested Fix

1. Add helmet() middleware for security headers
2. Set express.json({ limit: '1mb' }) to limit body size
3. Review CORS configuration to restrict origins

[aaniya22]

pls assign this to me under gssoc