mirror of
https://github.com/barkeser2002/offline-db.git
synced 2026-09-25 06:39:51 +03:00
Barış Keserandgoogle-labs-jules[bot]
3cacbf5f93
This change enhances the platform's security posture by implementing missing HTTP response headers as mandated by the project's security roadmap:
- Created a custom `SecurityHeadersMiddleware` to enforce `Referrer-Policy: strict-origin-when-cross-origin` and `Permissions-Policy: camera=(), microphone=()`.
- Updated `MIDDLEWARE` in `aniscrap_core/settings.py` to include the new custom middleware.
- Hardened the `django-csp` Content-Security-Policy settings to require nonces for inline scripts (`CSP_INCLUDE_NONCE_IN = ('script-src',)` and removed `'unsafe-inline'` from `CSP_SCRIPT_SRC`).
- Verified existing `SECURE_HSTS_SECONDS` configurations for production deployment.
- Added unit tests for the new custom middleware (`aniscrap_core/tests.py`).
- Updated project documentation (`development-plan.md` and `sentinel.md`) with task completion and new vulnerability prevention learnings.
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
15 lines
473 B
Python
15 lines
473 B
Python
class SecurityHeadersMiddleware:
|
|
def __init__(self, get_response):
|
|
self.get_response = get_response
|
|
|
|
def __call__(self, request):
|
|
response = self.get_response(request)
|
|
|
|
# Referrer-Policy: strict-origin-when-cross-origin
|
|
response['Referrer-Policy'] = 'strict-origin-when-cross-origin'
|
|
|
|
# Permissions-Policy (camera, microphone deny)
|
|
response['Permissions-Policy'] = 'camera=(), microphone=()'
|
|
|
|
return response
|