Expand description
Admin-port security hardening (#54): response headers + auth throttling.
Split out of serve.rs so the wiring stays readable and both pieces are
unit-testable in isolation.
Headers — every admin response carries a strict Content-Security-Policy
(the console is self-contained: no CDN, no inline scripts), clickjacking and
MIME-sniffing guards, and cache rules that keep token-guarded JSON out of
shared caches. HSTS is deliberately not set here: TLS terminates at the
ingress/reverse proxy (see lean-ctx-deploy SECURITY.md), and a backend-set
HSTS on a plain-HTTP loopback deployment would poison local browsers.
Throttle — fixed-window failed-auth limiter per client IP. The Bearer
token is 256-bit random (brute force is not a practical risk); the limiter
exists so scanners/mistyped scripts produce a clean, auditable signal (429 +
a tracing line per failure) instead of an unbounded 401 stream.
Structs§
- Auth
Throttle - Fixed-window failed-auth limiter per client IP (#54/#57).
Functions§
- security_
headers - Middleware: stamps the security headers on every admin-port response.