Add HTTP to HTTPS redirect and HSTS headers

[dkhalife]

Summary

Add security hardening by redirecting HTTP requests to HTTPS and setting HSTS (Strict-Transport-Security) headers.

Changes

API Server

• Add SecurityHeaders middleware that:
  • Redirects HTTP requests to HTTPS (301) using the X-Forwarded-Proto header
  • Supports non-standard ports in the redirect URL
  • Sets Strict-Transport-Security: max-age=31536000; includeSubDomains; preload header on HTTPS responses
• Register the middleware in the server startup
• Add unit tests covering HSTS header injection, HTTP redirect, non-standard port redirect, and HTTPS pass-through

MCP Server

• Enable UseHsts() and UseHttpsRedirection() in the ASP.NET Core pipeline

[codecov]

Codecov Report

❌ Patch coverage is 92.00000% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
apiserver/internal/utils/middleware/middleware.go	92.00%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

This PR hardens transport security by adding HTTP→HTTPS redirects and HSTS headers in both the Go API server (Gin middleware) and the .NET MCP server (ASP.NET Core pipeline).

Changes:

• Added SecurityHeaders Gin middleware to redirect HTTP requests to HTTPS and inject an HSTS header.
• Registered the new middleware in the API server startup pipeline.
• Added unit tests for redirect/HSTS behavior; enabled UseHsts() and UseHttpsRedirection() in the MCP server.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
mcpserver/Program.cs	Enables ASP.NET Core HSTS + HTTPS redirection middleware.
apiserver/main.go	Registers the new SecurityHeaders middleware in Gin startup.
apiserver/internal/utils/middleware/middleware.go	Implements SecurityHeaders middleware (redirect + HSTS).
apiserver/internal/utils/middleware/middleware_test.go	Adds unit tests for HSTS injection and redirect behavior.

Comments suppressed due to low confidence (1)

apiserver/internal/utils/middleware/middleware.go:59

• The redirect URL is built from cfg.Server.HostName and cfg.Server.Port, but cfg.Server.Port is also used as the server listen port (http.Server.Addr in main.go). In common reverse-proxy/container setups the internal listen port differs from the externally visible HTTPS port, which would cause redirects to an unreachable port. Prefer deriving host/port from forwarded headers (X-Forwarded-Host/X-Forwarded-Port) or c.Request.Host, and only fall back to config when explicitly set (also handle empty HostName).

func SecurityHeaders(cfg *config.Config) gin.HandlerFunc {
	hostName := cfg.Server.HostName
	port := cfg.Server.Port

	return func(c *gin.Context) {
		proto := c.GetHeader("X-Forwarded-Proto")
		if proto == "http" {
			target := fmt.Sprintf("https://%s", hostName)
			if port != 443 {
				target = fmt.Sprintf("%s:%d", target, port)
			}
			target = fmt.Sprintf("%s%s", target, c.Request.URL.RequestURI())
			c.Redirect(http.StatusMovedPermanently, target)