Add security headers middleware

src/Altinn.Broker.API/Helpers/SecurityHeadersMiddleware.cs

@@ -0,0 +1,19 @@
+using Microsoft.Extensions.Primitives;
+
+public class SecurityHeadersMiddleware
+{
+    private readonly RequestDelegate _next;
+
+    public SecurityHeadersMiddleware(RequestDelegate next)
+    {
+        _next = next;
+    }
+
+    public async Task InvokeAsync(HttpContext context)
+    {
+        context.Response.Headers.Append("X-Content-Type-Options", new StringValues("nosniff"));
+        context.Response.Headers.Append("Cache-Control", new StringValues("no-store"));
+
+        await _next(context);
+    }
+}

src/Altinn.Broker.API/Program.cs

@@ -69,6 +69,7 @@ static void BuildAndRun(string[] args)
 
     var app = builder.Build();
     app.UseMiddleware<RequestLoggingMiddleware>();
+    app.UseMiddleware<SecurityHeadersMiddleware>();
     app.UseSerilogRequestLogging();
 
     if (app.Environment.IsDevelopment())