A R R R Associates
41 lines
1.8 KiB
Python
41 lines
1.8 KiB
Python
from starlette.middleware.base import BaseHTTPMiddleware
|
|
from starlette.requests import Request
|
|
|
|
from app.core.security.session_auth import SESSION_USER_ID_KEY
|
|
|
|
|
|
class SecurityHeadersMiddleware(BaseHTTPMiddleware):
|
|
async def dispatch(self, request: Request, call_next):
|
|
# Capture authentication state before the route runs. Logout clears the
|
|
# session during the request, but its response must still be non-cacheable.
|
|
was_authenticated = bool(request.session.get(SESSION_USER_ID_KEY))
|
|
|
|
resp = await call_next(request)
|
|
resp.headers["X-Content-Type-Options"] = "nosniff"
|
|
resp.headers["X-Frame-Options"] = "DENY"
|
|
resp.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
|
|
resp.headers["Permissions-Policy"] = "geolocation=(), microphone=(), camera=()"
|
|
|
|
# CSP: allow Tailwind CDN only
|
|
resp.headers["Content-Security-Policy"] = (
|
|
"default-src 'self'; "
|
|
"style-src 'self' 'unsafe-inline' https://cdn.tailwindcss.com; "
|
|
"script-src 'self' 'unsafe-inline' https://cdn.tailwindcss.com; "
|
|
"img-src 'self' data:; "
|
|
"connect-src 'self'; "
|
|
"frame-ancestors 'none';"
|
|
)
|
|
|
|
# Authenticated ERP pages contain client, PAN, document, billing and
|
|
# engagement data. Prevent browsers and intermediary caches from storing
|
|
# them, including responses generated immediately before logout.
|
|
is_authenticated = bool(request.session.get(SESSION_USER_ID_KEY))
|
|
if was_authenticated or is_authenticated:
|
|
resp.headers["Cache-Control"] = (
|
|
"no-store, no-cache, must-revalidate, private, max-age=0"
|
|
)
|
|
resp.headers["Pragma"] = "no-cache"
|
|
resp.headers["Expires"] = "0"
|
|
|
|
return resp
|