37 lines
1.2 KiB
Python
37 lines
1.2 KiB
Python
from __future__ import annotations
|
|
|
|
from collections.abc import Callable
|
|
|
|
from django.http import HttpRequest, HttpResponse
|
|
|
|
|
|
class SecurityHeadersMiddleware:
|
|
"""Kleine CSP zonder externe assets; vacature-HTML wordt bovendien gesanitized."""
|
|
|
|
def __init__(self, get_response: Callable[[HttpRequest], HttpResponse]) -> None:
|
|
self.get_response = get_response
|
|
|
|
def __call__(self, request: HttpRequest) -> HttpResponse:
|
|
response = self.get_response(request)
|
|
response.headers.setdefault(
|
|
"Content-Security-Policy",
|
|
"; ".join(
|
|
[
|
|
"default-src 'self'",
|
|
"img-src 'self' data:",
|
|
"style-src 'self' 'unsafe-inline'",
|
|
"script-src 'self'",
|
|
"font-src 'self'",
|
|
"connect-src 'self'",
|
|
"frame-ancestors 'none'",
|
|
"base-uri 'self'",
|
|
"form-action 'self'",
|
|
]
|
|
),
|
|
)
|
|
response.headers.setdefault(
|
|
"Permissions-Policy", "camera=(), microphone=(), geolocation=()"
|
|
)
|
|
response.headers.setdefault("Cross-Origin-Opener-Policy", "same-origin")
|
|
return response
|