YvvandClaude Opus 5.5
67ddee28b2
- crates/ld-engine : formule inertielle (parité avec la maquette, garde C), coquille / changement de fond, assistant d'édition à règles, composition d'un document sous vote permanent (adoptions, aperçus, rivales). - crates/trustin-access : qui voit, qui ouvre, qui gère les accès. - crates/ld-server : API axum + SQLite, connexion Ğ1 (client OAuth2 de connect.monnaie-libre.fr), invitations, entrée en vigueur automatique, signalements de contradiction, traductions éditoriales, publication git, taille de la toile lue sur la chaîne. - seeds/acte-engagement-certification.json : 33 articles, fr + en + es ; en vigueur : préambule, E1, E2 (seed a minima). - maquette/ : frontend, backend et docker v2 déplacés tels quels. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
43 lines
1.5 KiB
Python
43 lines
1.5 KiB
Python
"""Security headers middleware: adds hardening headers to all responses.
|
|
|
|
Applies OWASP-recommended security headers to prevent common
|
|
web vulnerabilities (clickjacking, MIME sniffing, XSS, etc.).
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from starlette.middleware.base import BaseHTTPMiddleware
|
|
from starlette.requests import Request
|
|
from starlette.responses import Response
|
|
|
|
|
|
class SecurityHeadersMiddleware(BaseHTTPMiddleware):
|
|
"""Add security headers to all HTTP responses.
|
|
|
|
Headers applied:
|
|
- ``X-Content-Type-Options: nosniff``
|
|
- ``X-Frame-Options: DENY``
|
|
- ``X-XSS-Protection: 1; mode=block``
|
|
- ``Referrer-Policy: strict-origin-when-cross-origin``
|
|
- ``Content-Security-Policy: default-src 'self'``
|
|
- ``Strict-Transport-Security: max-age=31536000; includeSubDomains``
|
|
(only when the request was made over HTTPS)
|
|
"""
|
|
|
|
async def dispatch(self, request: Request, call_next) -> Response:
|
|
response = await call_next(request)
|
|
|
|
response.headers["X-Content-Type-Options"] = "nosniff"
|
|
response.headers["X-Frame-Options"] = "DENY"
|
|
response.headers["X-XSS-Protection"] = "1; mode=block"
|
|
response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
|
|
response.headers["Content-Security-Policy"] = "default-src 'self'"
|
|
|
|
# Only add HSTS header for HTTPS requests
|
|
if request.url.scheme == "https":
|
|
response.headers["Strict-Transport-Security"] = (
|
|
"max-age=31536000; includeSubDomains"
|
|
)
|
|
|
|
return response
|