security: add HTTP security headers, rate limiting on sensitive routes, and file upload extension validation

2026-11-01 16:46:03 +01:00
parent 2d44647f94
commit ef19221b62
7 changed files with 50 additions and 9 deletions
@@ -303,4 +303,12 @@ class AdminContentTest extends TestCase
        $guestOnlineResponse = $this->get(route('home'));
        $guestOnlineResponse->assertStatus(200);
    }
+
+    public function test_site_sends_modern_security_headers(): void
+    {
+        $response = $this->get('/');
+        $response->assertHeader('X-Frame-Options', 'SAMEORIGIN');
+        $response->assertHeader('X-Content-Type-Options', 'nosniff');
+        $response->assertHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
+    }
 }