From e8f45c1af68c5d1671aa0d5733548b78192c4dc1 Mon Sep 17 00:00:00 2001 From: codl Date: Mon, 28 Aug 2017 01:47:01 +0200 Subject: [PATCH] add security headers --- app.py | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/app.py b/app.py index 532df9f..ce7c0a4 100644 --- a/app.py +++ b/app.py @@ -71,3 +71,20 @@ def rate_limit_key(): return request.remote_addr limiter = Limiter(app, key_func=rate_limit_key) + +@app.after_request +def install_security_headers(resp): + csp = "default-src 'none'; img-src 'self' https: http:; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; frame-ancestors 'none'" + if 'CSP_REPORT_URI' in app.config: + csp += "; report-uri " + app.config.get('CSP_REPORT_URI') + resp.headers.set('Content-Security-Policy', csp) + + if app.config.get('HTTPS'): + resp.headers.set('strict-transport-security', 'max-age: {}'.format(60*60*24*365)) + + resp.headers.set('referrer-policy', 'no-referrer') + resp.headers.set('x-content-type-options', 'nosniff') + resp.headers.set('x-frame-options', 'DENY') + resp.headers.set('x-xss-protection', '0') + + return resp