15 lines
708 B
Python
15 lines
708 B
Python
class SecurityHeaders:
|
|
def __init__(self, get_response):
|
|
self.get_response = get_response
|
|
|
|
def __call__(self, request):
|
|
response = self.get_response(request)
|
|
response["Content-Security-Policy"] = (
|
|
"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'"
|
|
)
|
|
response["Referrer-Policy"] = "same-origin"
|
|
response["Permissions-Policy"] = "camera=(), microphone=(), geolocation=()"
|
|
if request.path.startswith("/api/"):
|
|
response["Cache-Control"] = "no-store"
|
|
return response
|