Skip to content

Conversation

Copy link
Contributor

Copilot AI commented Jan 24, 2026

The application was missing the Strict-Transport-Security header, leaving it vulnerable to man-in-the-middle attacks.

Changes

  • Extended SecurityMiddleware in api/app_factory.py to inject HSTS header on all responses

    • max-age=31536000 (1 year)
    • includeSubDomains
    • preload (eligible for browser preload lists)
  • Added test coverage in tests/test_hsts_header.py verifying header presence and directives across endpoints

Implementation

The HSTS header is now added via the existing middleware layer, ensuring all HTTP responses include the security header:

class SecurityMiddleware(BaseHTTPMiddleware):
    async def dispatch(self, request: Request, call_next):
        # ... existing security checks ...
        response = await call_next(request)
        
        # Add HSTS header
        hsts_value = "max-age=31536000; includeSubDomains; preload"
        response.headers["Strict-Transport-Security"] = hsts_value
        
        return response

Response headers now include:

strict-transport-security: max-age=31536000; includeSubDomains; preload
Original prompt

This section details on the original issue you should resolve

<issue_title>Add HSTS header</issue_title>
<issue_description>The missing HSTS header exposes the organization to man-in-the-middle attacks.

• Verify the absence of the Strict-Transport-Security header in the output.

</issue_description>

Comments on the Issue (you are @copilot in this section)


💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

Copilot AI and others added 2 commits January 24, 2026 18:18
Co-authored-by: gkorland <753206+gkorland@users.noreply.github.com>
Co-authored-by: gkorland <753206+gkorland@users.noreply.github.com>
Copilot AI changed the title [WIP] Add HSTS header to improve security Add HSTS header to prevent MITM attacks Jan 24, 2026
Copilot AI requested a review from gkorland January 24, 2026 18:21
@gkorland gkorland marked this pull request as ready for review January 24, 2026 19:01
@github-actions
Copy link

github-actions bot commented Jan 24, 2026

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

@coderabbitai
Copy link
Contributor

coderabbitai bot commented Jan 24, 2026

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.


Comment @coderabbitai help to get the list of available commands and usage tips.

@gkorland gkorland changed the base branch from main to staging January 24, 2026 19:04
@gkorland gkorland merged commit 48eba40 into staging Jan 24, 2026
11 checks passed
@gkorland gkorland deleted the copilot/add-hsts-header branch January 24, 2026 19:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add HSTS header

2 participants