Barış Keserandgoogle-labs-jules[bot] 3cacbf5f93 feat: Implement comprehensive security HTTP headers (#310) ...

This change enhances the platform's security posture by implementing missing HTTP response headers as mandated by the project's security roadmap:
- Created a custom `SecurityHeadersMiddleware` to enforce `Referrer-Policy: strict-origin-when-cross-origin` and `Permissions-Policy: camera=(), microphone=()`.
- Updated `MIDDLEWARE` in `aniscrap_core/settings.py` to include the new custom middleware.
- Hardened the `django-csp` Content-Security-Policy settings to require nonces for inline scripts (`CSP_INCLUDE_NONCE_IN = ('script-src',)` and removed `'unsafe-inline'` from `CSP_SCRIPT_SRC`).
- Verified existing `SECURE_HSTS_SECONDS` configurations for production deployment.
- Added unit tests for the new custom middleware (`aniscrap_core/tests.py`).
- Updated project documentation (`development-plan.md` and `sentinel.md`) with task completion and new vulnerability prevention learnings.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>

2026-03-21 20:36:05 +00:00

0 lines

0 B

Python

Raw Permalink Blame History

The file is empty.