Security: session cookie flags and global security headers

[rupertgermann]

Parent

#6

What to build

Two hardening gaps from the security audit (H2, H3), shipped together because both are response-attribute concerns. First, the workspace session cookie gains HttpOnly and SameSite=Lax always, and the Secure flag when the request arrives over HTTPS or when an environment flag forces it (for TLS-terminating proxies). Second, every response carries standard security headers via framework-level header configuration: X-Content-Type-Options, Referrer-Policy, X-Frame-Options/frame-ancestors protection, Permissions-Policy, and a Content-Security-Policy in report-only mode (enforcement is explicitly out of scope).

Acceptance criteria

• Session Set-Cookie includes HttpOnly and SameSite=Lax on every issuance
• Set-Cookie includes Secure for HTTPS requests and when the environment override flag is set; plain local HTTP without the flag omits it so dev still works
• Responses include X-Content-Type-Options: nosniff, a Referrer-Policy, frame-ancestors/X-Frame-Options protection, a Permissions-Policy, and Content-Security-Policy-Report-Only
• Existing pages render and the app works in dev and production builds with the headers active
• TDD: cookie behavior covered at the route-handler seam (inspect Set-Cookie on responses); header configuration verified by test where the seam allows; npm test green

Blocked by

None - can start immediately