Missing Security Headers (ARCH5141)

Key go.security.missing-security-headers · Severity info · Category security · CWE CWE-693

The file that calls http.ListenAndServe (or r.Run, e.Start, app.Listen) is where a headers middleware (unrolled/secure, fiber helmet, echo middleware.Secure) is installed. When it does neither that nor set Strict-Transport-Security, Content-Security-Policy or X-Content-Type-Options by hand, the app answers without them. Reported as info: a reverse proxy may add them.

Incorrect

func main() {
  http.HandleFunc("/", index)
  http.ListenAndServe(":8080", nil)
}

Correct

func main() {
  sec := secure.New(secure.Options{
    STSSeconds:            31536000,
    ContentTypeNosniff:    true,
    ContentSecurityPolicy: "default-src 'self'",
  })
  http.HandleFunc("/", index)
  http.ListenAndServe(":8080", sec.Handler(http.DefaultServeMux))
}

Fix

Wrap the handler in a headers middleware, or set Strict-Transport-Security, Content-Security-Policy and X-Content-Type-Options: nosniff on every response.