A R R R Associates
22 lines
943 B
Python
22 lines
943 B
Python
from starlette.middleware.base import BaseHTTPMiddleware
|
|
from starlette.requests import Request
|
|
|
|
class SecurityHeadersMiddleware(BaseHTTPMiddleware):
|
|
async def dispatch(self, request: Request, call_next):
|
|
resp = await call_next(request)
|
|
resp.headers["X-Content-Type-Options"] = "nosniff"
|
|
resp.headers["X-Frame-Options"] = "DENY"
|
|
resp.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
|
|
resp.headers["Permissions-Policy"] = "geolocation=(), microphone=(), camera=()"
|
|
|
|
# CSP: allow Tailwind CDN only
|
|
resp.headers["Content-Security-Policy"] = (
|
|
"default-src 'self'; "
|
|
"style-src 'self' 'unsafe-inline' https://cdn.tailwindcss.com; "
|
|
"script-src 'self' 'unsafe-inline' https://cdn.tailwindcss.com; "
|
|
"img-src 'self' data:; "
|
|
"connect-src 'self'; "
|
|
"frame-ancestors 'none';"
|
|
)
|
|
return resp
|