24 lines
769 B
Python
24 lines
769 B
Python
from django.conf import settings
|
|
|
|
|
|
class SecurityHeadersMiddleware:
|
|
"""Add security-related HTTP headers to every response."""
|
|
|
|
def __init__(self, get_response):
|
|
self.get_response = get_response
|
|
|
|
def __call__(self, request):
|
|
response = self.get_response(request)
|
|
|
|
if not settings.DEBUG:
|
|
response["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
|
|
|
|
response.setdefault("X-Content-Type-Options", "nosniff")
|
|
response.setdefault("X-Frame-Options", "DENY")
|
|
response.setdefault("Referrer-Policy", "strict-origin-when-cross-origin")
|
|
response.setdefault(
|
|
"Permissions-Policy",
|
|
"geolocation=(), microphone=(), camera=()",
|
|
)
|
|
|
|
return response |