Add security headers and the production CORS posture #58

New issue

Closed

opened 2026-07-05 19:21:30 +01:00 by TimCane · 0 comments

TimCane commented

2026-07-05 19:21:30 +01:00

(Migrated from github.com)

Goal

X-Content-Type-Options, Referrer-Policy: no-referrer, a CSP (default-src 'self', connect-src 'self' wss:, img-src 'self' data:), no CORS in prod (permissive only for the Vite dev origin), no cookies.

References

Done when

Advances M7 A4 (deployed instance secure).

Part of M7: Hardening.

## Goal X-Content-Type-Options, Referrer-Policy: no-referrer, a CSP (default-src 'self', connect-src 'self' wss:, img-src 'self' data:), no CORS in prod (permissive only for the Vite dev origin), no cookies. ## References - [docs/10-security-privacy.md#transport-and-headers](https://github.com/TimCane/bill-splitter/blob/main/docs/10-security-privacy.md#transport-and-headers) - [docs/07-backend-design.md](https://github.com/TimCane/bill-splitter/blob/main/docs/07-backend-design.md) ## Done when - Advances M7 A4 (deployed instance secure). --- Part of **M7: Hardening**.