Merge remote-tracking branch 'origin/main' into fix/api-without-googlefix/api-without-google

2 files changed, 18 insertions, 0 deletions

diff --git a/apps/api/Security/ForwardedHeadersPolicy.cs b/apps/api/Security/ForwardedHeadersPolicy.cs
index 046ad56..776c1e4 100644
--- a/apps/api/Security/ForwardedHeadersPolicy.cs
+++ b/apps/api/Security/ForwardedHeadersPolicy.cs
@@ -6,11 +6,20 @@ using Microsoft.AspNetCore.HttpOverrides;
 
 namespace Progmasoft.Progmaweb.Api.Security;
 
+/// <summary>Decides which forwarded headers the API trusts.</summary>
+/// <remarks>
+/// The API listens on loopback behind Nginx and the Next.js server. Only those local proxies may state the client
+/// address, host and scheme; the authentication rate limiter depends on the client address being genuine.
+/// </remarks>
 internal static class ForwardedHeadersPolicy
 {
+    /// <summary>Number of proxy hops whose headers are read.</summary>
     internal const int MaximumForwardedHops = 1;
+    /// <summary>Addresses of the proxies that may send forwarded headers.</summary>
     internal static readonly IPAddress[] TrustedProxies = [IPAddress.Loopback, IPAddress.IPv6Loopback];
 
+    /// <summary>Applies the policy to the forwarded-headers middleware.</summary>
+    /// <param name="options">Options to configure.</param>
     public static void Configure(ForwardedHeadersOptions options)
     {
         options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedHost |
diff --git a/apps/api/Security/SecurityHeadersMiddleware.cs b/apps/api/Security/SecurityHeadersMiddleware.cs
index 42383ef..d17a3fe 100644
--- a/apps/api/Security/SecurityHeadersMiddleware.cs
+++ b/apps/api/Security/SecurityHeadersMiddleware.cs
@@ -3,8 +3,17 @@
 
 namespace Progmasoft.Progmaweb.Api.Security;
 
+/// <summary>Adds the security headers of a JSON API to every response.</summary>
+/// <remarks>
+/// The API serves no documents, so its content security policy allows nothing, it may not be framed, and its
+/// responses are never cached.
+/// </remarks>
+/// <param name="next">The next middleware in the pipeline.</param>
 internal sealed class SecurityHeadersMiddleware(RequestDelegate next)
 {
+    /// <summary>Sets the headers and continues the pipeline.</summary>
+    /// <param name="context">The current request.</param>
+    /// <returns>A task that completes when the rest of the pipeline has run.</returns>
     public async Task InvokeAsync(HttpContext context)
     {
         IHeaderDictionary headers = context.Response.Headers;