feat: implement API security measures phase 1

api/accounts/middleware.py

@@ -0,0 +1,24 @@
+from django.conf import settings
+
+
+class SecurityHeadersMiddleware:
+    """Add security-related HTTP headers to every response."""
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        response = self.get_response(request)
+
+        if not settings.DEBUG:
+            response["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
+
+        response.setdefault("X-Content-Type-Options", "nosniff")
+        response.setdefault("X-Frame-Options", "DENY")
+        response.setdefault("Referrer-Policy", "strict-origin-when-cross-origin")
+        response.setdefault(
+            "Permissions-Policy",
+            "geolocation=(), microphone=(), camera=()",
+        )
+
+        return response