Description
main.ts (src/main.ts) configures CORS, a global ValidationPipe, Sentry, and Swagger, but never applies any HTTP security headers middleware (no Helmet or equivalent). There's no helmet dependency in package.json either. As a result the API ships without Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, a restrictive Content-Security-Policy for the Swagger UI it serves at /api/docs, and other standard hardening headers that are close to zero-cost to add for a NestJS/Express app.
Component
Backend
Difficulty
🟢 Easy
Tasks
Acceptance Criteria
Estimated Time
3-4 hours
Description
main.ts(src/main.ts) configures CORS, a globalValidationPipe, Sentry, and Swagger, but never applies any HTTP security headers middleware (no Helmet or equivalent). There's nohelmetdependency inpackage.jsoneither. As a result the API ships withoutStrict-Transport-Security,X-Content-Type-Options,X-Frame-Options, a restrictiveContent-Security-Policyfor the Swagger UI it serves at/api/docs, and other standard hardening headers that are close to zero-cost to add for a NestJS/Express app.Component
Backend
Difficulty
🟢 Easy
Tasks
helmetpackage as a dependencybootstrap()(src/main.ts) before other middleware, with a CSP configuration compatible with the Swagger UI served at/api/docsAcceptance Criteria
/api/docs(Swagger UI) continues to render correctly with the new CSP in placeEstimated Time
3-4 hours