Problem
The project does not use @fastify/helmet or set security headers like X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security, or Content-Security-Policy.
While the API serves JSON (not HTML), missing X-Content-Type-Options: nosniff can allow MIME sniffing attacks on responses.
Impact
- Potential MIME sniffing attacks
- Missing OWASP security headers
- Lower security posture
Fix
Install and configure @fastify/helmet:
npm install @fastify/helmet
import helmet from '@fastify/helmet';
await app.register(helmet, {
contentSecurityPolicy: false, // Disable for API
crossOriginEmbedderPolicy: false,
});Scope
- Install
@fastify/helmet
- Update
src/server.ts -- register plugin
Acceptance Criteria
- Security headers are present in responses
X-Content-Type-Options: nosniff is set- API functionality is not affected
- Existing tests pass
Technical Context
src/server.ts -- Fastify setup- OWASP security headers recommendation
Problem
The project does not use
@fastify/helmetor set security headers likeX-Content-Type-Options,X-Frame-Options,Strict-Transport-Security, orContent-Security-Policy.While the API serves JSON (not HTML), missing
X-Content-Type-Options: nosniffcan allow MIME sniffing attacks on responses.Impact
Fix
Install and configure
@fastify/helmet:Scope
@fastify/helmetsrc/server.ts-- register pluginAcceptance Criteria
X-Content-Type-Options: nosniffis setTechnical Context
src/server.ts-- Fastify setup