fix: keep public security headers authoritative

2026-08-25 23:17:42 +08:00
parent 1fbfa32fbd
commit bfd84ccdb5
3 changed files with 14 additions and 2 deletions
@@ -72,7 +72,16 @@ func (a *publicApp) routes() http.Handler {
 	mux.HandleFunc("GET /health", func(w http.ResponseWriter, _ *http.Request) {
 		writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
 	})
-	return a.core.securityHeaders(mux)
+	return a.securityHeaders(mux)
+}
+
+func (a *publicApp) securityHeaders(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Cache-Control", "no-store")
+		w.Header().Set("Cross-Origin-Opener-Policy", "same-origin")
+		w.Header().Set("X-Frame-Options", "DENY")
+		next.ServeHTTP(w, r)
+	})
 }

 func (a *publicApp) index(w http.ResponseWriter, r *http.Request) {