Add panic recovery and HTTP security headers #11

New issue

Closed

opened 2026-09-04 23:26:08 +02:00 by arne · 0 comments

arne commented

2026-09-04 23:26:08 +02:00

Owner

Protect the HTTP boundary with recovery and baseline browser security middleware.

Acceptance criteria:

Panics in downstream handlers are recovered, logged with request context, and returned as a generic 500 response without leaking panic details.
Responses include documented baseline headers for content-type sniffing, framing, referrer policy, and other headers appropriate to Fjomp’s same-origin UI.
Middleware ordering preserves request IDs and structured logging for recovered requests.
Tests cover panic recovery, non-panicking requests, and the security headers on representative success and error responses.
make check passes.

Dependencies:

Depends on #9 and #10.

Protect the HTTP boundary with recovery and baseline browser security middleware. Acceptance criteria: - Panics in downstream handlers are recovered, logged with request context, and returned as a generic 500 response without leaking panic details. - Responses include documented baseline headers for content-type sniffing, framing, referrer policy, and other headers appropriate to Fjomp’s same-origin UI. - Middleware ordering preserves request IDs and structured logging for recovered requests. - Tests cover panic recovery, non-panicking requests, and the security headers on representative success and error responses. - `make check` passes. Dependencies: - Depends on #9 and #10.

arne added this to the Milestone 1: runtime foundation milestone

2026-09-04 23:26:08 +02:00

arne referenced this issue

2026-09-04 23:26:17 +02:00

Add liveness and readiness endpoints #13

arne referenced this issue

2026-09-04 23:26:35 +02:00

Add base page layout and standard error responses #15

arne referenced this issue from a pull request that will close it,

2026-09-05 08:26:40 +02:00

Add panic recovery and HTTP security headers #26

arne referenced this issue from a commit