// src/middleware/securityHeaders.js
// === SECURITY HARDENING ===
// Security headers middleware for admin dashboard
// Prevents clickjacking and enforces security best practices

/**
 * Security headers middleware
 * Sets security headers including frameguard to prevent clickjacking
 */
function securityHeaders(req, res, next) {
  // === SECURITY HARDENING: CLICKJACKING PROTECTION ===
  // Prevent page from being embedded in iframes
  res.setHeader('X-Frame-Options', 'DENY');
  
  // === SECURITY HARDENING: CONTENT TYPE PROTECTION ===
  // Prevent MIME type sniffing
  res.setHeader('X-Content-Type-Options', 'nosniff');
  
  // === SECURITY HARDENING: XSS PROTECTION ===
  // Enable XSS filter (legacy, but still useful)
  res.setHeader('X-XSS-Protection', '1; mode=block');
  
  // === SECURITY HARDENING: HTTPS ENFORCEMENT ===
  // Force HTTPS in production (if behind proxy)
  if (process.env.NODE_ENV === 'production') {
    res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
  }
  
  next();
}

module.exports = securityHeaders;

