security(hardening): add helmet and standard secure headers in main.ts

[phertyameen]

Summary

backend/src/main.ts sets up validation, correlation IDs, exception filters, Swagger, CORS, and graceful shutdown - but no helmet() (or equivalent header middleware). The API therefore serves responses without X-Content-Type-Options, Strict-Transport-Security, X-Frame-Options, etc. For an API holding auth tokens and user metadata (a geolocation middleware already enriches requests), these are low-cost wins.

Proposal

1. Add the helmet dependency and app.use(helmet()) early in bootstrap; verify Swagger UI at /api still renders afterwards.
2. Gate HSTS behind NODE_ENV=production using the existing config namespace pattern (app.config.ts).
3. Set crossOriginResourcePolicy compatible with the frontend origin allowlist from the CORS work.

Acceptance criteria

• Secure headers present on all responses in production mode.
• Swagger UI at /api still loads locally.
• Change covered by a smoke assertion (e.g. e2e test asserting X-Content-Type-Options: nosniff).

[guptakumarranjeet150]

Hello team,

I can tackle security(hardening): add helmet and standard secure headers in main.ts. Proposed implementation roadmap:

• Analysis: Inspect current behavior and edge cases in MindBlockLabs/mindBlock_app
• Core Implementation: Deliver a clean, well-tested implementation for security(hardening): add helmet and standard secure headers in main.ts following MindBlockLabs/mindBlock_app conventions.
• Quality Assurance: Validate end-to-end functionality before submitting the PR.

Ready to deliver a clean, tested PR within 12–24 hours. Please assign!

[guptakumarranjeet150]

Hello team,

I am interested in working on this issue.
Plan:

1. Implement security(hardening): add helmet and standard secure headers in main.ts with modular design, clear documentation, and clean commit history.
2. Include automated test coverage verifying the implementation meets expected requirements.

I can start working on this right away. Please assign!