security: response headers + non-breaking CSP (frame-ancestors/object-src/base-uri) + patch /api/render error-message leak (Cody-hardened)

1bd39925391d573367ad7493cdbcdd460727f072 · 2026-08-03 11:14:28 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit 1bd39925391d573367ad7493cdbcdd460727f072
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon Aug 3 11:14:28 2026 -0700

    security: response headers + non-breaking CSP (frame-ancestors/object-src/base-uri) + patch /api/render error-message leak (Cody-hardened)
---
 server.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/server.js b/server.js
index 70da6cc..37b5dca 100644
--- a/server.js
+++ b/server.js
@@ -24,6 +24,7 @@ app.use((_req, res, next) => {
   res.set('X-Frame-Options', 'SAMEORIGIN');
   res.set('Referrer-Policy', 'strict-origin-when-cross-origin');
   res.set('Permissions-Policy', 'camera=(), microphone=(), geolocation=(), browsing-topics=()');
+  res.set('Content-Security-Policy', "frame-ancestors 'self'; object-src 'none'; base-uri 'none'");
   next();
 });

← c34917c snapshot before deploy: in-tree security headers (nosniff/fr · back to Interiordesignershowroom · auto-save: 2026-08-03T11:23:33 (1 files) — server.js 41049f5 →