blob: eb64129c6e0b328f64e571228626121bbb20d38a (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
|
"""Security response headers."""
from __future__ import annotations
from collections.abc import Awaitable, Callable
from starlette.middleware.base import BaseHTTPMiddleware
from starlette.requests import Request
from starlette.responses import Response
class SecurityHeadersMiddleware(BaseHTTPMiddleware):
"""Attach browser security headers to every response."""
async def dispatch(
self,
request: Request,
call_next: Callable[[Request], Awaitable[Response]],
) -> Response:
response = await call_next(request)
response.headers.setdefault(
"Content-Security-Policy",
(
"default-src 'self'; "
"script-src 'self'; "
"connect-src 'self'; "
"img-src 'self' data: blob:; "
"media-src 'self'; "
"style-src 'self' 'unsafe-inline'; "
"font-src 'self'; "
"base-uri 'self'; "
"frame-ancestors 'none'"
),
)
response.headers.setdefault("X-Content-Type-Options", "nosniff")
response.headers.setdefault("Referrer-Policy", "same-origin")
return response
|
