Security Headers & CORS

SecurityHeadersMiddleware (provided by craft-easy and tuned with Petanque Life defaults) is mounted ahead of every other handler so every response — including errors — carries the right headers. CORS is configured per environment and per app: production ships an explicit origin allowlist for the admin app, the player app, the federation CMS, the marketing site and petanque.life itself; development adds localhost; wildcard origins are rejected at config-load through a model_validator so an accidental commit cannot loosen production. Allowed methods, headers, exposed headers, credentials and preflight max-age are each configurable.

Content-Security-Policy is enforced with per-request nonces. SecurityHeadersMiddleware generates a fresh secrets.token_urlsafe(16) per request, injects it into the CSP script-src and style-src directives via a {nonce} placeholder, and exposes it on request.state.csp_nonce so SSR templates can stamp the matching nonce on inline blocks. Frame-ancestors is 'none', base-uri is 'self', form-action is 'self' and upgrade-insecure-requests is on, so a hijacked third-party script cannot inject untrusted content or downgrade transport.

HSTS ships with max-age=31536000; includeSubDomains; preload on every HTTPS response, omitted on plain HTTP, and respects X-Forwarded-Proto behind the Container Apps ingress so the proxy terminates TLS but the origin still sees the right scheme. X-Frame-Options is DENY by default — admin and API will not load inside an iframe — configurable through SECURITY_HEADERS_X_FRAME_OPTIONS for the rare embed case. Referrer-Policy defaults to strict-origin (stricter than craft-easy's strict-origin-when-cross-origin), so outbound links leak the origin only, never path or query.

Permissions-Policy is locked down per app type: camera, microphone, geolocation, payment, USB, magnetometer, gyroscope, accelerometer, ambient-light-sensor, autoplay all disabled by default; fullscreen, encrypted-media and picture-in-picture allowed only same-origin so the apps can still play media and go fullscreen for scoreboards. Subresource Integrity is managed through an SriAsset model and a public manifest at GET /sri/manifest with sha256/384/512 hash computation; admin CRUD lets ops add or rotate CDN assets and re-verify, ensuring a compromised CDN cannot serve malicious payloads under a trusted URL. Security.txt (RFC 9116) is on the roadmap to advertise the disclosure channel.