security: add security headers to all API responses

[Crackhead-gsk]

Summary

Found during an internal security review. ApiResponse (the single choke point every controller uses to build JSON responses) only set Content-Type and CORS headers - no X-Content-Type-Options, X-Frame-Options, or Content-Security-Policy.

Added a shared SECURITY_HEADERS set applied to success(), error(), exception(), and sendManualResponse():

• X-Content-Type-Options: nosniff
• X-Frame-Options: DENY
• Content-Security-Policy: default-src 'none' - this is a pure JSON API (confirmed via the earlier audit and by inspection - no controller ever returns HTML), so a maximally restrictive CSP has zero functional impact on legitimate clients.
• Referrer-Policy: no-referrer - several endpoints put tokens in query strings (e.g. reset-password?token=..., upload-signed?token=...); this avoids leaking them via the Referer header on any outbound request/navigation.

Testing

Deployed live against a running instance and confirmed via curl -i that all four headers are present on both success and error responses (e.g. logout, forgot-password), with the JSON response body completely unchanged - no functional regression. php -l clean.

Notes

Did not touch the existing Access-Control-Allow-Origin: * + Access-Control-Allow-Credentials: true combination flagged in the same audit - that's a separate, more invasive change (needs an actual origin allowlist instead of a wildcard) that deserves its own PR and more careful testing against the real frontend origins, rather than bundling it with this low-risk header addition.

Summary by CodeRabbit

• Security
  • Added standard security headers to API responses, including protections against content-type sniffing, clickjacking, restricted framing, unwanted referrer sharing, and unintended content loading.
  • Applied these protections consistently across successful responses, errors, exceptions, and manually generated responses.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 06a735d5-fe37-4e97-98bb-6f1a116c8a29

📥 Commits

Reviewing files that changed from the base of the PR and between 5e57b96 and 964eecd.

📒 Files selected for processing (1)

• backend/app/Helpers/ApiResponse.php

Included review availability: Your plan provides up to 2 included reviews per hour; 0 remain after this review.

---

Walkthrough

ApiResponse now adds four security headers to success, error, exception, and manual responses through one shared constant.

Changes

API Security Headers

Layer / File(s)	Summary
Shared security header application backend/app/Helpers/ApiResponse.php	Defines SECURITY_HEADERS with nosniff, DENY, a restrictive Content Security Policy, and no-referrer. All response factory methods merge these headers with existing Content-Type and CORS headers.

Merge Risk: ⚪ Minimal · up to 964ee

API success, error, exception, and manual responses now include four protective browser-facing headers while preserving JSON bodies and existing CORS behavior. No merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding security headers to all API responses.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[NaysKutzu]

Wrong brach, applied via a .patch