fix: send HSTS on HTTPS document responses

Add Strict-Transport-Security (max-age=63072000; includeSubDomains) in applySecurityHeaders, gated on x-forwarded-proto === 'https' so a plain-HTTP dev/misconfig deploy never pins the browser to HTTPS (audit LOW). Tested. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-13 21:52:54 +02:00
parent e960aae163
commit 90f2398e56
5 changed files with 28 additions and 5 deletions
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
  "name": "mangalord-frontend",
-  "version": "0.128.22",
+  "version": "0.128.23",
  "private": true,
  "type": "module",
  "scripts": {