ollama - 💡(How to fix) Fix [MEDIUM] Missing security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy)

Severity: MEDIUM -- CVSS 4.3

Location: server/routes.go (GenerateRoutes), HTTP responses Category: Missing Security Headers Confidence: Certain CWE: CWE-693 MITRE ATT&CK: T1189

Description

The web server does not set key security headers:

• No HSTS (Strict-Transport-Security) -- if proxied through nginx/traefik with TLS, there is no HSTS enforcement
• No CSP (Content-Security-Policy) -- inline scripts/styles not restricted
• No X-Content-Type-Options: nosniff -- MIME type sniffing protection
• No X-Frame-Options or frame-ancestors -- clickjacking protection
• No Referrer-Policy -- referrer information leakage control
• No Permissions-Policy -- browser feature restrictions

While ollama primarily serves JSON API responses (not HTML), these headers are defense-in-depth best practices, especially important if ollama is exposed behind a reverse proxy that also serves a web UI (Open WebUI, etc.).

Remediation

Add a simple security headers middleware:

func securityHeaders() gin.HandlerFunc {
    return func(c *gin.Context) {
        c.Header("X-Content-Type-Options", "nosniff")
        c.Header("X-Frame-Options", "DENY")
        c.Header("Referrer-Policy", "strict-origin-when-cross-origin")
        c.Next()
    }
}

Then add to routes: r.Use(securityHeaders())

Found as part of a broader security audit of ollama/ollama.