SecurityHeaders (middleware/security_headers.go)

Middleware that sets security headers and escapes base href for safe HTML rendering.

// Source: https://github.com/mudler/LocalAI | License: MIT | Copyright 2023-2025 Ettore Di Giacinto (mudler@localai.io)
// Provided via justclaw.it.com; keep this notice with the code.
package middleware

import (
	"html"

	"github.com/labstack/echo/v4"
)

// SecurityHeaders sets headers that limit the blast radius of any XSS bug
// that slips through. The CSP keeps script-src permissive because the Vite
// bundle relies on inline + eval'd scripts; tightening it requires moving
// to a nonce-based policy.
func SecurityHeaders() echo.MiddlewareFunc {
	const csp = "default-src 'self'; " +
		"script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:; " +
		"style-src 'self' 'unsafe-inline'; " +
		"img-src 'self' data: blob: https:; " +
		"media-src 'self' data: blob:; " +
		"font-src 'self' data

... (truncated -- full source via MCP)