Deduplicate HTTP security headers between nginx and Flask-Talisman

[szachovy]

Summary

• nginx (services/superset/nginx.conf) and Superset's own Flask-Talisman middleware both independently add Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, and Referrer-Policy to every response. add_header doesn't replace upstream headers, it appends — so responses carried duplicates with different values, and per spec/browser handling this wasn't "defense in depth," it was silent misconfiguration:
  • HSTS: RFC 6797 mandates only the first STS header is processed. Superset's weaker copy (no preload) came first, so nginx's preload copy was spec-mandated to be ignored entirely.
  • X-Frame-Options: SAMEORIGIN vs DENY risked comma-joining into an invalid value on some browsers (documented: Safari 6.0.5), which can drop clickjacking protection entirely.
  • Referrer-Policy: UAs take the last valid policy across combined headers — nginx's weaker legacy default (no-referrer-when-downgrade) silently overrode Superset's stricter strict-origin-when-cross-origin.
  • Only nginx's HSTS line carried always, so its other four headers vanished on non-2xx/3xx responses (404, 500) — the response was only still hardened because Talisman's headers are unconditional.

Fix

• Added proxy_hide_header for all five headers so Talisman's upstream copies never reach the client, and made nginx's own add_header lines (all now with always) the sole source of truth — headers now survive on error pages too.
• Corrected Referrer-Policy to strict-origin-when-cross-origin. Kept X-Frame-Options: DENY (nginx's existing, stricter value — no dashboard-embedding feature exists anywhere in this repo, so nothing depends on same-origin framing).
• Left Talisman's TALISMAN_CONFIG/CSP entirely untouched. Reconfiguring Talisman instead would have required replicating Superset's internal default CSP dict verbatim to safely override the monolithic TALISMAN_CONFIG, without ground-truth on the exact defaults shipped in apache/superset:4.0.2 — not worth the risk of silently weakening CSP when the nginx-side fix is fully sufficient.
• Added CHANGELOG.md entry under ### Fixed.

Test plan

• Added status_headers() to functional_superset.py, following the existing status_database/status_swarm pattern (auto-runs via the Overlay metaclass on instantiation, no functional.yml changes needed). Curls both / and a nonexistent path, asserts each of the 5 headers appears exactly once with the exact expected value on both — directly encodes this PR's acceptance criteria as a regression test.
• python3 -m py_compile, flake8, pylint all pass on the modified test file (two pylint import-error warnings are pre-existing and confirmed unrelated by diffing against master).
• Manually simulated the header-parsing logic against realistic curl -I output.
• No live docker/cluster access in the environment this was developed in — worth running the new functional test (and nginx -t) against an actual deployment before merge.