🛡️ Sentinel: [security improvement] Add X-Frame-Options to allowed response headers

[matdev83]

🚨 Severity: MEDIUM
💡 Vulnerability: Missing X-Frame-Options security header
🎯 Impact: This exposes the proxy to clickjacking attacks
🔧 Fix: Add X-Frame-Options to the annotateResponseHeaderNames allowlist
✅ Verification: Review the updated map logic in internal/stdhttp/auth/middleware.go

---

PR created automatically by Jules for task 17310671901500430560 started by @matdev83

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 33528161-c4d2-44b4-96c9-84ac285b1e13

📥 Commits

Reviewing files that changed from the base of the PR and between efe4624 and cb9b7a3.

📒 Files selected for processing (1)

• internal/stdhttp/auth/middleware.go

📜 Recent review details

⏰ Context from checks skipped due to timeout. (5)

• GitHub Check: qa-run
• GitHub Check: Cursor Security Agent: Security Reviewer
• GitHub Check: Analyze (actions)
• GitHub Check: Analyze (go)
• GitHub Check: Analyze (javascript-typescript)

🧰 Additional context used

📓 Path-based instructions (3)

**/*.go

📄 CodeRabbit inference engine (Custom checks)

**/*.go: For server, CLI, worker, or network Go code, ensure context.Context is propagated correctly, cancellation is respected, and new goroutines cannot leak indefinitely.
Do not make accidental public API breaks in Go code: under pkg/** or anywhere exported Go identifiers are changed, warn if the PR changes exported types, function signatures, error behavior, JSON fields, CLI flags, config keys, or documented behavior without clearly explaining the compatibility impact.

Files:

• internal/stdhttp/auth/middleware.go

---

⚙️ CodeRabbit configuration file

**/*.go: Review as production Go code. Prioritize correctness, race conditions, goroutine leaks, context cancellation, timeout handling, error wrapping, nil-pointer risks, resource cleanup, defer placement, API compatibility, interface design, dependency boundaries, and testability. Avoid generic style comments when gofmt/golangci-lint already covers the issue.

Files:

• internal/stdhttp/auth/middleware.go

**/*

📄 CodeRabbit inference engine (Custom checks)

Do not introduce hardcoded credentials, API keys, tokens, private keys, passwords, production secrets, or sensitive internal URLs.

Files:

• internal/stdhttp/auth/middleware.go

internal/**

⚙️ CodeRabbit configuration file

internal/**: Focus on package boundaries, hidden coupling, unexported API design, concurrency safety, deterministic behavior, and whether logic belongs in this internal package.

Files:

• internal/stdhttp/auth/middleware.go

🧠 Learnings (1)

📚 Learning: 2026-07-01T22:57:42.953Z

Learnt from: matdev83
Repo: matdev83/go-llm-interactive-proxy PR: 101
File: pkg/lipsdk/scope/context.go:0-0
Timestamp: 2026-07-01T22:57:42.953Z
Learning: In this repository, when defining unexported Go `context` key constants of type `ctxKey int` (e.g., `const ( kFoo ctxKey = iota + N )`), preserve the `iota + <offset>` pattern and keep the existing `<offset>` values rather than simplifying to plain `iota`. These per-package offsets are part of the repo-wide convention to avoid key collisions across packages, and each such constant set should include a short explanatory comment (for example: “offset avoids collision with other packages' context keys”).

Applied to files:

• internal/stdhttp/auth/middleware.go

🔇 Additional comments (1)

internal/stdhttp/auth/middleware.go (1)

32-32: LGTM!

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Authentication responses can now preserve the X-Frame-Options security header when provider-supplied headers are merged.

Walkthrough

Changes

Authentication header filtering

Layer / File(s)	Summary
Allow X-Frame-Options in annotated responses internal/stdhttp/auth/middleware.go	Adds X-Frame-Options to the success-path response header allow-list used during annotation merging.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 8

✅ Passed checks (8 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the security change to allow X-Frame-Options in response headers.
Description check	✅ Passed	The description directly matches the change and its security motivation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No Secrets	✅ Passed	The diff only adds X-Frame-Options to a response-header allowlist; no credentials, tokens, keys, passwords, or sensitive URLs are introduced.
Context Propagation	✅ Passed	PASS: The PR only adds X-Frame-Options to a header allowlist; no context, goroutine, or cancellation logic was changed in middleware.go.
No Accidental Public Api Break	✅ Passed	Only an internal allow-list entry changed; no exported Go identifiers, signatures, config keys, or public API surface were modified.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}