# go-http-middleware (extracted)

Generic HTTP middleware: security headers (CSP configurable), CORS. Source: backend/api/middleware/security.go. Consumer passes CSP string when wiring.