ok

server-rs/src/main.rs

@@ -8,6 +8,7 @@ mod checkout_sessions;
 mod consts;
 mod data;
 mod features;
+mod generated_data_pages;
 mod language;
 mod metrics;
 mod og_middleware;
@@ -124,6 +125,30 @@ async fn static_cache_headers(
     response
 }
 
+/// Add baseline security headers to every response. These are deliberately the
+/// low-risk, broadly-compatible set: a Content-Security-Policy and
+/// Permissions-Policy are intentionally left out because this app loads many
+/// cross-origin resources (maplibre/deck.gl, Stripe, Google Street View,
+/// analytics, the error sink) and a mis-scoped policy would break the map or
+/// checkout. They should be added later as report-only first.
+async fn security_headers(
+    request: axum::extract::Request,
+    next: middleware::Next,
+) -> axum::response::Response {
+    let mut response = next.run(request).await;
+    let headers = response.headers_mut();
+    headers
+        .entry(header::X_CONTENT_TYPE_OPTIONS)
+        .or_insert(HeaderValue::from_static("nosniff"));
+    headers
+        .entry(header::X_FRAME_OPTIONS)
+        .or_insert(HeaderValue::from_static("SAMEORIGIN"));
+    headers
+        .entry(header::REFERRER_POLICY)
+        .or_insert(HeaderValue::from_static("strict-origin-when-cross-origin"));
+    response
+}
+
 #[cfg(target_os = "linux")]
 fn resident_memory_kib() -> Option<u64> {
     let status = std::fs::read_to_string("/proc/self/status").ok()?;
@@ -998,7 +1023,7 @@ async fn main() -> anyhow::Result<()> {
             "/pb/{*rest}",
             any(routes::proxy_to_pocketbase).layer(ConcurrencyLimitLayer::new(10)),
         )
-        // Tile routes use a different state type — kept as closures
+        // Tile routes use a different state type, kept as closures
         .route(
             "/api/tiles/{z}/{x}/{y}",
             get(move |path| routes::get_tile(axum::extract::State(reader_tile.clone()), path))
@@ -1087,7 +1112,9 @@ async fn main() -> anyhow::Result<()> {
         .route("/health", get(|| async { "ok" }))
         .route(
             "/metrics",
-            get(move |connect_info| metrics::metrics_handler(metrics_handle.clone(), connect_info)),
+            get(move |headers, connect_info| {
+                metrics::metrics_handler(metrics_handle.clone(), headers, connect_info)
+            }),
         )
         .with_state(shared.clone());
 
@@ -1112,6 +1139,7 @@ async fn main() -> anyhow::Result<()> {
         },
     ))
     .layer(middleware::from_fn(static_cache_headers))
+    .layer(middleware::from_fn(security_headers))
     .layer(middleware::from_fn(capture_server_error_responses))
     .layer(cors)
     .layer(CompressionLayer::new().zstd(true).gzip(true))
@@ -1125,8 +1153,8 @@ async fn main() -> anyhow::Result<()> {
     );
 
     // NOTE: we deliberately do NOT mlockall() here. Locking MCL_CURRENT|MCL_FUTURE
-    // pinned the allocator's entire mapped heap — including jemalloc's freed/dirty
-    // pages — resident and non-reclaimable, inflating RSS from the ~10GB working
+    // pinned the allocator's entire mapped heap, including jemalloc's freed/dirty
+    // pages, resident and non-reclaimable, inflating RSS from the ~10GB working
     // set to ~40GB and defeating the allocator's page-return entirely. The hot
     // working set stays resident naturally; freed pages are returned to the OS.