address code review feedback from CodeRabbit

Author: johanbriger

src/main/java/org/juv25d/App.java

@@ -20,6 +20,9 @@ public static void main(String[] args) {
         HttpParser httpParser = new HttpParser();
 
         Pipeline pipeline = new Pipeline();
+
+        pipeline.addGlobalFilter(new SecurityHeadersFilter(), 0);
+
         // Configure redirect rules
         List<RedirectRule> redirectRules = List.of(
             new RedirectRule("/old-page", "/new-page", 301),
@@ -28,7 +31,6 @@ public static void main(String[] args) {
         );
         pipeline.addGlobalFilter(new RedirectFilter(redirectRules), 0);
 
-
         // IP filter is enabled but configured with open access during development
         // White/blacklist can be tightened when specific IP restrictions are decided
         pipeline.addGlobalFilter(new IpFilter(

src/main/java/org/juv25d/filter/SecurityHeadersFilter.java

@@ -13,13 +13,16 @@ public class SecurityHeadersFilter implements Filter {
 
         @Override
         public void doFilter(HttpRequest req, HttpResponse res, FilterChain chain) throws IOException {
-            chain.doFilter(req, res);
+            try {
+                chain.doFilter(req, res);
+            } finally {
 
-            res.setHeader("X-Content-Type-Options", "nosniff");
-            res.setHeader("X-Frame-Options", "DENY");
-            res.setHeader("X-XSS-Protection", "0");
-            res.setHeader("Referrer-Policy", "no-referrer");
+                res.setHeader("X-Content-Type-Options", "nosniff");
+                res.setHeader("X-Frame-Options", "DENY");
+                res.setHeader("X-XSS-Protection", "0");
+                res.setHeader("Referrer-Policy", "no-referrer");
 
+            }
         }
     }