Security hardening: Helmet, CORS allowlist, and HTTPS enforcement

[Josie123-Dev]

What

Add Helmet.js for security headers, replace the permissive CORS configuration with an environment-driven allowlist, and add HTTPS enforcement middleware to the NestJS backend.

Why

The backend currently has three security gaps:

1. app.enableCors({ origin: true }) allows requests from any origin — this is acceptable in development but dangerous in production for a health-data platform
2. No security headers (CSP, HSTS, X-Frame-Options, etc.) are set — Helmet.js is the standard NestJS middleware for this
3. No HTTPS enforcement — HTTP requests are served without redirect

These are OWASP Top 10 adjacent issues (A05:2021 Security Misconfiguration) and should be addressed before any production deployment.

Scope

In scope:

• Install and configure @nestjs/helmet in the backend
• Replace app.enableCors({ origin: true }) with environment-variable-driven CORS allowlist (CORS_ORIGINS env var, comma-separated)
• Add a middleware that redirects HTTP to HTTPS in production (behind ENABLE_HTTPS_REDIRECT env var)
• Add CORS_ORIGINS and ENABLE_HTTPS_REDIRECT to .env.example

Out of scope:

• WAF configuration
• DDoS protection
• SSL certificate provisioning
• Frontend security headers (Next.js has its own mechanism)

Acceptance Criteria

• @nestjs/helmet is installed and applied in main.ts
• CORS origin is read from CORS_ORIGINS env var (comma-separated list)
• In development, CORS allows http://localhost:3000 by default
• In production, only listed origins are allowed
• HTTPS redirect middleware is active when ENABLE_HTTPS_REDIRECT=true
• .env.example includes the new env vars with comments
• Security headers are present in HTTP responses (verify with curl -I)

Technical Context

• Main bootstrap: backend/src/main.ts
• Current CORS: app.enableCors({ origin: true }) — replace this line
• Install: npm install @nestjs/helmet helmet
• NestJS middleware docs: https://docs.nestjs.com/security/helmet
• For CORS allowlist: use app.enableCors({ origin: origins.split(',') }) pattern

[Shollyhano]

I would love to work on this issue