Harden web UI security

1 files changed, 36 insertions, 0 deletions

diff --git a/src/ollama_web/middleware.py b/src/ollama_web/middleware.py
new file mode 100644
index 0000000..bbddbac
--- /dev/null
+++ b/src/ollama_web/middleware.py
@@ -0,0 +1,36 @@
+"""Security response headers."""
+
+from __future__ import annotations
+
+from collections.abc import Awaitable, Callable
+
+from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.requests import Request
+from starlette.responses import Response
+
+
+class SecurityHeadersMiddleware(BaseHTTPMiddleware):
+    """Attach browser security headers to every response."""
+
+    async def dispatch(
+        self,
+        request: Request,
+        call_next: Callable[[Request], Awaitable[Response]],
+    ) -> Response:
+        response = await call_next(request)
+        response.headers.setdefault(
+            "Content-Security-Policy",
+            (
+                "default-src 'self'; "
+                "script-src 'self'; "
+                "connect-src 'self'; "
+                "img-src 'self' data: blob:; "
+                "style-src 'self' 'unsafe-inline'; "
+                "font-src 'self'; "
+                "base-uri 'self'; "
+                "frame-ancestors 'none'"
+            ),
+        )
+        response.headers.setdefault("X-Content-Type-Options", "nosniff")
+        response.headers.setdefault("Referrer-Policy", "same-origin")
+        return response