Missing Security Headers (ARCH9141)

Key swift.security.missing-security-headers · Severity info · Category security · CWE CWE-693

Flags a Vapor configure(_:) that installs no security-headers middleware and names no security header.

Incorrect

func configure(_ app: Application) throws {
    try routes(app)
}

Correct

func configure(_ app: Application) throws {
    app.middleware.use(SecurityHeadersMiddleware())
    try routes(app)
}

Fix

Add a middleware that sets Strict-Transport-Security, Content-Security-Policy and X-Content-Type-Options: nosniff on every response.