Merge remote-tracking branch 'origin/main' into fix/api-without-googlefix/api-without-google

1 files changed, 9 insertions, 0 deletions

diff --git a/apps/api/Security/SecurityHeadersMiddleware.cs b/apps/api/Security/SecurityHeadersMiddleware.cs
index 42383ef..d17a3fe 100644
--- a/apps/api/Security/SecurityHeadersMiddleware.cs
+++ b/apps/api/Security/SecurityHeadersMiddleware.cs
@@ -3,8 +3,17 @@
 
 namespace Progmasoft.Progmaweb.Api.Security;
 
+/// <summary>Adds the security headers of a JSON API to every response.</summary>
+/// <remarks>
+/// The API serves no documents, so its content security policy allows nothing, it may not be framed, and its
+/// responses are never cached.
+/// </remarks>
+/// <param name="next">The next middleware in the pipeline.</param>
 internal sealed class SecurityHeadersMiddleware(RequestDelegate next)
 {
+    /// <summary>Sets the headers and continues the pipeline.</summary>
+    /// <param name="context">The current request.</param>
+    /// <returns>A task that completes when the rest of the pipeline has run.</returns>
     public async Task InvokeAsync(HttpContext context)
     {
         IHeaderDictionary headers = context.Response.Headers;