ENG-1855 Privacy Center security headers

[tvandort]

Ticket ENG-1855

Description Of Changes

This PR adds security related headers to Privacy Center responses when the Privacy Center environment variable FIDES_PRIVACY_CENTER__SECURITY_HEADERS_MODE is set to recommended.

The security headers added to every response are:

• X-Content-Type-Options: "nosniff"
• Cache-Control: "no-cache, no-store, must-revalidate"
• Strict-Transport-Security: "max-age=31536000"

The security headers conditionally added are:

• X-Frame-Options SAMEORIGIN on everything but /embedded-consent.html

The security headers added to "page like" responses are:

• Content-Security-Policy. This Policy changes depend on the mode and configuration of Fides please review the PR.

Steps to Confirm

1. Set FIDES_PRIVACY_CENTER__SECURITY_HEADERS_MODE to recommended
2. Start Privacy Center
3. Visit Privacy center in a browser
4. Check the response headers on / index
5. Check the response headers on /fides.js
6. Check the response headers on _next/* paths

Pre-Merge Checklist

• Issue requirements met
• All CI pipelines succeeded
• CHANGELOG.md updated
  • Add a db-migration This indicates that a change includes a database migration label to the entry if your change includes a DB migration
  • Add a high-risk This issue suggests changes that have a high-probability of breaking existing code label to the entry if your change includes a high-risk change (i.e. potential for performance impact or unexpected regression) that should be flagged
  • Updates unreleased work already in Changelog, no new entry necessary
• UX feedback:
  • All UX related changes have been reviewed by a designer
  • No UX review needed
• Followup issues:
  • Followup issues created
  • No followup issues
• Database migrations:
  • Ensure that your downrev is up to date with the latest revision on main
  • Ensure that your downgrade() migration is correct and works
    • If a downgrade migration is not possible for this change, please call this out in the PR description!
  • No migrations
• Documentation:
  • Documentation complete, PR opened in fidesdocs
  • Documentation issue created in fidesdocs
  • If there are any new client scopes created as part of the pull request, remember to update public-facing documentation that references our scope registry
  • No documentation updates required

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Preview	Comments	Updated (UTC)
fides-plus-nightly	Ignored	Preview		Dec 5, 2025 5:54pm
fides-privacy-center	Ignored			Dec 5, 2025 5:54pm

[greptile-apps]

Greptile Overview

Greptile Summary

Adds security headers to Privacy Center responses when FIDES_PRIVACY_CENTER__SECURITY_HEADERS_MODE is set to recommended. The implementation includes standard security headers (X-Content-Type-Options, Cache-Control, Strict-Transport-Security) and content-specific CSP policies with nonce support for dynamic pages.

Major Issues Found:

• Malformed regex on line 75 of recommendedSecurityHeaders.ts - the pattern /\/?!embedded-consent\.html/ has incorrect negative lookahead syntax
• Regex on line 79 has trailing pipe | that matches empty strings, causing unintended matcher behavior
• Missing test coverage for critical regex matchers that control security header routing

Architecture:

• Clean separation with header utilities in headers.ts and security-specific rules in recommendedSecurityHeaders.ts
• Middleware properly caches settings to avoid repeated parsing
• CSP policies differentiated by page type (static vs dynamic vs embedded)

Confidence Score: 2/5

• Not safe to merge - contains regex bugs that break security header routing
• Two critical regex syntax errors will cause X-Frame-Options and CSP headers to apply incorrectly. The malformed negative lookahead and trailing pipe operator mean security headers won't be applied to the right paths, potentially leaving pages unprotected or breaking embedded consent functionality
• recommendedSecurityHeaders.ts requires immediate fixes to regex patterns before merging

Important Files Changed

File Analysis

Filename	Score	Overview
clients/privacy-center/app/server-utils/recommendedSecurityHeaders.ts	2/5	Implements CSP headers and security rules with regex pattern issue on line 75
clients/privacy-center/middleware.ts	4/5	Integrates security headers into middleware with proper caching
clients/privacy-center/app/server-utils/headers.ts	5/5	Clean header utility implementation with good separation of concerns
clients/privacy-center/tests/server-utils/recommendedSecurityHeaders.test.ts	4/5	Tests CSP header generation but lacks regex matcher validation

[greptile-apps]

_{9 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile
React with 👍 or 👎 to share your feedback on this new summary format}

[gilluminate]

@tvandort when I test this locally, it breaks the Demo page
/fides-js-demo.html?geolocation=us-ut

[tvandort]

@tvandort when I test this locally, it breaks the Demo page /fides-js-demo.html?geolocation=us-ut

Yeah I noticed this just after putting the PR. I need to do something more nuanced than what I've done here so I'm currently working on that.

Will address other review comments and rerequest when done.

[tvandort]

@gilluminate I refactored this pretty significantly which I think in turn addressed all your review comments. Of course... everything is now pretty different so it might be worthwhile to pretend it's new.

[tvandort]

@greptileai

[greptile-apps]

_{10 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}