From e4d421c782a181f421e2987f75b4610845e3ef55 Mon Sep 17 00:00:00 2001 From: tanaka takashi Date: Wed, 24 Jun 2026 22:47:13 +0900 Subject: Harden web UI security --- src/ollama_web/middleware.py | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 src/ollama_web/middleware.py (limited to 'src/ollama_web/middleware.py') diff --git a/src/ollama_web/middleware.py b/src/ollama_web/middleware.py new file mode 100644 index 0000000..bbddbac --- /dev/null +++ b/src/ollama_web/middleware.py @@ -0,0 +1,36 @@ +"""Security response headers.""" + +from __future__ import annotations + +from collections.abc import Awaitable, Callable + +from starlette.middleware.base import BaseHTTPMiddleware +from starlette.requests import Request +from starlette.responses import Response + + +class SecurityHeadersMiddleware(BaseHTTPMiddleware): + """Attach browser security headers to every response.""" + + async def dispatch( + self, + request: Request, + call_next: Callable[[Request], Awaitable[Response]], + ) -> Response: + response = await call_next(request) + response.headers.setdefault( + "Content-Security-Policy", + ( + "default-src 'self'; " + "script-src 'self'; " + "connect-src 'self'; " + "img-src 'self' data: blob:; " + "style-src 'self' 'unsafe-inline'; " + "font-src 'self'; " + "base-uri 'self'; " + "frame-ancestors 'none'" + ), + ) + response.headers.setdefault("X-Content-Type-Options", "nosniff") + response.headers.setdefault("Referrer-Policy", "same-origin") + return response -- cgit v1.2.3