INNER CODE UNIT · Python

SecurityHeadersMiddleware

Yacht-sh/Yacht · backend/api/main.py:97

class SecurityHeadersMiddleware(BaseHTTPMiddleware):
    async def dispatch(self, request: Request, call_next):
        response = await call_next(request)
        if not settings.ENABLE_SECURITY_HEADERS:
            return response

        response.headers.setdefault("X-Content-Type-Options", "nosniff")
        response.headers.setdefault("X-Frame-Options", "DENY")
        response.headers.setdefault("Referrer-Policy", "no-referrer")
        response.headers.setdefault(
            "Permissions-Policy", "camera=(), geolocation=(), microphone=()"
        )
        response.headers.setdefault("Cross-Origin-Opener-Policy", "same-origin")
        response.headers.setdefault("Cross-Origin-Resource-Policy", "same-origin")
        if settings.SECURE_COOKIES and settings.HSTS_SECONDS > 0:
            response.headers.setdefault(
                "Strict-Transport-Security",
                f"max-age={settings.HSTS_SECONDS}; includeSubDomains",

View source record →