From 11a2282c3e28c0c83ad1a9b0e24ea8065e4f4610 Mon Sep 17 00:00:00 2001
From: Bryan Frimin <bryan@getprobo.com>
Date: Mon, 23 Jun 2025 09:07:27 -0700
Subject: [PATCH] Add default security header to API

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
---
 pkg/server/api/api.go | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkg/server/api/api.go b/pkg/server/api/api.go
index 2c4377cb1..63e83ce5b 100644
--- a/pkg/server/api/api.go
+++ b/pkg/server/api/api.go
@@ -100,6 +100,13 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		Debug:              false,
 	}
 
+	// Default API security headers
+	w.Header().Set("X-Frame-Options", "DENY")
+	w.Header().Set("X-XSS-Protection", "0")
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+	w.Header().Set("Referrer-Policy", "no-referrer")
+	w.Header().Set("Content-Security-Policy", "default-src 'self'")
+
 	router := chi.NewRouter()
 	router.MethodNotAllowed(methodNotAllowed)
 	router.NotFound(notFound)