././@PaxHeader 0000000 0000000 0000000 00000000033 00000000000 010211 x ustar 00 27 mtime=1671787347.053118
secure-0.3.0/ 0000755 0001745 0001745 00000000000 14351271523 012751 5 ustar 00janitor janitor ././@PaxHeader 0000000 0000000 0000000 00000000026 00000000000 010213 x ustar 00 22 mtime=1628725770.0
secure-0.3.0/LICENSE 0000644 0001745 0001745 00000002055 14105061012 013743 0 ustar 00janitor janitor MIT License
Copyright (c) 2021 Caleb Kinney
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
././@PaxHeader 0000000 0000000 0000000 00000000026 00000000000 010213 x ustar 00 22 mtime=1628725770.0
secure-0.3.0/MANIFEST.in 0000644 0001745 0001745 00000000062 14105061012 014470 0 ustar 00janitor janitor include README.md LICENSE
prune tests*
prune docs* ././@PaxHeader 0000000 0000000 0000000 00000000033 00000000000 010211 x ustar 00 27 mtime=1671787347.053118
secure-0.3.0/PKG-INFO 0000644 0001745 0001745 00000012562 14351271523 014054 0 ustar 00janitor janitor Metadata-Version: 2.1
Name: secure
Version: 0.3.0
Summary: A lightweight package that adds security headers for Python web frameworks.
Home-page: https://github.com/TypeError/secure
Author: Caleb Kinney
Author-email: caleb@derail.io
License: MIT
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.6
Classifier: Programming Language :: Python :: 3.7
Classifier: Programming Language :: Python :: 3.8
Classifier: Programming Language :: Python :: 3.9
Requires-Python: >=3.6
Description-Content-Type: text/markdown
License-File: LICENSE
# secure.py
[](https://pypi.org/project/secure/)
[](https://www.python.org/downloads/)
[](https://pypi.org/project/secure/)
[](https://github.com/psf/black)
[](https://travis-ci.org/TypeError/secure)
secure.py 🔒 is a lightweight package that adds optional security headers for Python web frameworks.
## Supported Python web frameworks
[aiohttp](https://docs.aiohttp.org), [Bottle](https://bottlepy.org), [CherryPy](https://cherrypy.org), [Django](https://www.djangoproject.com), [Falcon](https://falconframework.org), [FastAPI](https://fastapi.tiangolo.com), [Flask](http://flask.pocoo.org), [hug](http://www.hug.rest), [Masonite](https://docs.masoniteproject.com), [Pyramid](https://trypyramid.com), [Quart](https://pgjones.gitlab.io/quart/), [Responder](https://python-responder.org), [Sanic](https://sanicframework.org), [Starlette](https://www.starlette.io/), [Tornado](https://www.tornadoweb.org/)
## Install
**pip**:
```console
pip install secure
```
**Pipenv**:
```console
pipenv install secure
```
After installing secure:
```Python
import secure
secure_headers = secure.Secure()
```
## Secure Headers
### Example
`secure_headers.framework(response)`
**Default HTTP response headers:**
```HTTP
strict-transport-security: max-age=63072000; includeSubdomains
x-frame-options: SAMEORIGIN
x-xss-protection: 0
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
cache-control: no-store
```
## Policy Builders
### Policy Builder Example
**Content Security Policy builder:**
```python
csp = (
secure.ContentSecurityPolicy()
.default_src("'none'")
.base_uri("'self'")
.connect_src("'self'", "api.spam.com")
.frame_src("'none'")
.img_src("'self'", "static.spam.com")
)
secure_headers = secure.Secure(csp=csp)
```
**HTTP response headers:**
```HTTP
strict-transport-security: max-age=63072000; includeSubdomains
x-frame-options: SAMEORIGIN
x-xss-protection: 0
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
cache-control: no-store
content-security-policy: default-src 'none'; base-uri 'self'; connect-src 'self' api.spam.com; frame-src 'none'; img-src 'self' static.spam.com"
```
## Documentation
Please see the full set of documentation at [https://secure.readthedocs.io](https://secure.readthedocs.io)
## FastAPI Example
```python
import uvicorn
from fastapi import FastAPI
import secure
app = FastAPI()
server = secure.Server().set("Secure")
csp = (
secure.ContentSecurityPolicy()
.default_src("'none'")
.base_uri("'self'")
.connect_src("'self'" "api.spam.com")
.frame_src("'none'")
.img_src("'self'", "static.spam.com")
)
hsts = secure.StrictTransportSecurity().include_subdomains().preload().max_age(2592000)
referrer = secure.ReferrerPolicy().no_referrer()
permissions_value = (
secure.PermissionsPolicy().geolocation("self", "'spam.com'").vibrate()
)
cache_value = secure.CacheControl().must_revalidate()
secure_headers = secure.Secure(
server=server,
csp=csp,
hsts=hsts,
referrer=referrer,
permissions=permissions_value,
cache=cache_value,
)
@app.middleware("http")
async def set_secure_headers(request, call_next):
response = await call_next(request)
secure_headers.framework.fastapi(response)
return response
@app.get("/")
async def root():
return {"message": "Secure"}
if __name__ == "__main__":
uvicorn.run(app, port=8081, host="localhost")
```
**HTTP response headers:**
```HTTP
server: Secure
strict-transport-security: includeSubDomains; preload; max-age=2592000
x-frame-options: SAMEORIGIN
x-xss-protection: 0
x-content-type-options: nosniff
content-security-policy: default-src 'none'; base-uri 'self'; connect-src 'self'api.spam.com; frame-src 'none'; img-src 'self' static.spam.com
referrer-policy: no-referrer
cache-control: must-revalidate
permissions-policy: geolocation=(self 'spam.com'), vibrate=()
```
## Resources
- [kennethreitz/setup.py: 📦 A Human’s Ultimate Guide to setup.py.](https://github.com/kennethreitz/setup.py)
- [OWASP - Secure Headers Project](https://www.owasp.org/index.php/OWASP_Secure_Headers_Project)
- [Mozilla Web Security](https://infosec.mozilla.org/guidelines/web_security)
- [securityheaders.com](https://securityheaders.com)
- [MDN Web Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers#security)
- [web.dev](https://web.dev)
- [The World Wide Web Consortium (W3C)](https://www.w3.org)
././@PaxHeader 0000000 0000000 0000000 00000000026 00000000000 010213 x ustar 00 22 mtime=1628725770.0
secure-0.3.0/README.md 0000644 0001745 0001745 00000011317 14105061012 014216 0 ustar 00janitor janitor # secure.py
[](https://pypi.org/project/secure/)
[](https://www.python.org/downloads/)
[](https://pypi.org/project/secure/)
[](https://github.com/psf/black)
[](https://travis-ci.org/TypeError/secure)
secure.py 🔒 is a lightweight package that adds optional security headers for Python web frameworks.
## Supported Python web frameworks
[aiohttp](https://docs.aiohttp.org), [Bottle](https://bottlepy.org), [CherryPy](https://cherrypy.org), [Django](https://www.djangoproject.com), [Falcon](https://falconframework.org), [FastAPI](https://fastapi.tiangolo.com), [Flask](http://flask.pocoo.org), [hug](http://www.hug.rest), [Masonite](https://docs.masoniteproject.com), [Pyramid](https://trypyramid.com), [Quart](https://pgjones.gitlab.io/quart/), [Responder](https://python-responder.org), [Sanic](https://sanicframework.org), [Starlette](https://www.starlette.io/), [Tornado](https://www.tornadoweb.org/)
## Install
**pip**:
```console
pip install secure
```
**Pipenv**:
```console
pipenv install secure
```
After installing secure:
```Python
import secure
secure_headers = secure.Secure()
```
## Secure Headers
### Example
`secure_headers.framework(response)`
**Default HTTP response headers:**
```HTTP
strict-transport-security: max-age=63072000; includeSubdomains
x-frame-options: SAMEORIGIN
x-xss-protection: 0
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
cache-control: no-store
```
## Policy Builders
### Policy Builder Example
**Content Security Policy builder:**
```python
csp = (
secure.ContentSecurityPolicy()
.default_src("'none'")
.base_uri("'self'")
.connect_src("'self'", "api.spam.com")
.frame_src("'none'")
.img_src("'self'", "static.spam.com")
)
secure_headers = secure.Secure(csp=csp)
```
**HTTP response headers:**
```HTTP
strict-transport-security: max-age=63072000; includeSubdomains
x-frame-options: SAMEORIGIN
x-xss-protection: 0
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
cache-control: no-store
content-security-policy: default-src 'none'; base-uri 'self'; connect-src 'self' api.spam.com; frame-src 'none'; img-src 'self' static.spam.com"
```
## Documentation
Please see the full set of documentation at [https://secure.readthedocs.io](https://secure.readthedocs.io)
## FastAPI Example
```python
import uvicorn
from fastapi import FastAPI
import secure
app = FastAPI()
server = secure.Server().set("Secure")
csp = (
secure.ContentSecurityPolicy()
.default_src("'none'")
.base_uri("'self'")
.connect_src("'self'" "api.spam.com")
.frame_src("'none'")
.img_src("'self'", "static.spam.com")
)
hsts = secure.StrictTransportSecurity().include_subdomains().preload().max_age(2592000)
referrer = secure.ReferrerPolicy().no_referrer()
permissions_value = (
secure.PermissionsPolicy().geolocation("self", "'spam.com'").vibrate()
)
cache_value = secure.CacheControl().must_revalidate()
secure_headers = secure.Secure(
server=server,
csp=csp,
hsts=hsts,
referrer=referrer,
permissions=permissions_value,
cache=cache_value,
)
@app.middleware("http")
async def set_secure_headers(request, call_next):
response = await call_next(request)
secure_headers.framework.fastapi(response)
return response
@app.get("/")
async def root():
return {"message": "Secure"}
if __name__ == "__main__":
uvicorn.run(app, port=8081, host="localhost")
```
**HTTP response headers:**
```HTTP
server: Secure
strict-transport-security: includeSubDomains; preload; max-age=2592000
x-frame-options: SAMEORIGIN
x-xss-protection: 0
x-content-type-options: nosniff
content-security-policy: default-src 'none'; base-uri 'self'; connect-src 'self'api.spam.com; frame-src 'none'; img-src 'self' static.spam.com
referrer-policy: no-referrer
cache-control: must-revalidate
permissions-policy: geolocation=(self 'spam.com'), vibrate=()
```
## Resources
- [kennethreitz/setup.py: 📦 A Human’s Ultimate Guide to setup.py.](https://github.com/kennethreitz/setup.py)
- [OWASP - Secure Headers Project](https://www.owasp.org/index.php/OWASP_Secure_Headers_Project)
- [Mozilla Web Security](https://infosec.mozilla.org/guidelines/web_security)
- [securityheaders.com](https://securityheaders.com)
- [MDN Web Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers#security)
- [web.dev](https://web.dev)
- [The World Wide Web Consortium (W3C)](https://www.w3.org)
././@PaxHeader 0000000 0000000 0000000 00000000033 00000000000 010211 x ustar 00 27 mtime=1671787347.053118
secure-0.3.0/secure/ 0000755 0001745 0001745 00000000000 14351271523 014237 5 ustar 00janitor janitor ././@PaxHeader 0000000 0000000 0000000 00000000026 00000000000 010213 x ustar 00 22 mtime=1628725770.0
secure-0.3.0/secure/__init__.py 0000644 0001745 0001745 00000001221 14105061012 016327 0 ustar 00janitor janitor from secure.headers import CacheControl as CacheControl
from secure.headers import ContentSecurityPolicy as ContentSecurityPolicy
from secure.headers import PermissionsPolicy as PermissionsPolicy
from secure.headers import ReferrerPolicy as ReferrerPolicy
from secure.headers import ReportTo as ReportTo
from secure.headers import Server as Server
from secure.headers import StrictTransportSecurity as StrictTransportSecurity
from secure.headers import XContentTypeOptions as XContentTypeOptions
from secure.headers import XFrameOptions as XFrameOptions
from secure.headers import XXSSProtection as XXSSProtection
from secure.secure import Secure as Secure
././@PaxHeader 0000000 0000000 0000000 00000000026 00000000000 010213 x ustar 00 22 mtime=1628725770.0
secure-0.3.0/secure/headers.py 0000644 0001745 0001745 00000073425 14105061012 016222 0 ustar 00janitor janitor # Header information and recommendations are adapted from:
# - OWASP Secure Headers Project (https://owasp.org/www-project-secure-headers/)
# - MDN Web Docs (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers#security)
# - web.dev (https://web.dev)
# - The World Wide Web Consortium (W3C) (https://www.w3.org)
import json
from typing import Dict, List, Optional, Union
import warnings
class Server:
"""Replace server header"""
def __init__(self) -> None:
self.header = "Server"
self.value = "NULL"
def set(self, value: str) -> "Server":
"""Set custom value for `Server` header
:param value: custom header value
:type value: str
:return: Server class
:rtype: Server
"""
self.value = value
return self
class XContentTypeOptions:
"""Prevent MIME-sniffing
Resources:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
https://owasp.org/www-project-secure-headers/#x-content-type-options
"""
def __init__(self) -> None:
self.header = "X-Content-Type-Options"
self.value = "nosniff"
def set(self, value: str) -> "XContentTypeOptions":
"""Set custom value for `X-Content-Type-Options` header
:param value: custom header value
:type value: str
:return: XContentTypeOptions class
:rtype: XContentTypeOptions
"""
self.value = value
return self
class ReportTo:
"""Configure reporting endpoints
Resources:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-to
https://developers.google.com/web/updates/2018/09/reportingapi
:param max_age: endpoint TIL in seconds
:type max_age: int
:param include_subdomains: enable for subdomains, defaults to False
:type include_subdomains: bool, optional
:param group: endpoint name, defaults to None
:type group: Optional[str], optional
:param endpoints: variable number of endpoints
:type endpoints: List[Dict[str, Union[str, int]]]
"""
def __init__(
self,
max_age: int,
include_subdomains: bool = False,
group: Optional[str] = None,
*endpoints: List[Dict[str, Union[str, int]]],
) -> None:
self.header = "Report-To"
report_to_endpoints = json.dumps(endpoints)
report_to_object: Dict[str, Union[str, int]] = {
"max_age": max_age,
"endpoints": report_to_endpoints,
}
if group:
report_to_object["group"] = group
if include_subdomains:
report_to_object["include_subdomains"] = include_subdomains
self.value = json.dumps(report_to_object)
def set(self, value: str) -> "ReportTo":
"""Set custom value for `Report-To` header
:param value: custom header value
:type value: str
:return: ReportTo class
:rtype: ReportTo
"""
self.value = value
return self
class ContentSecurityPolicy:
"""
Prevent Cross-site injections
Resources:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
https://developers.google.com/web/fundamentals/security/csp
"""
def __init__(self) -> None:
self.__policy: List[str] = []
self.header = "Content-Security-Policy"
self.value = "script-src 'self'; object-src 'self'"
def _build(self, directive: str, *sources: str) -> None:
if len(sources) == 0:
self.__policy.append(directive)
else:
self.__policy.append(f"{directive} {' '.join(sources)}")
self.value = "; ".join(self.__policy)
def set(self, value: str) -> "ContentSecurityPolicy":
"""Set custom value for `Content-Security-Policy` header
:param value: custom header value
:type value: str
:return: ContentSecurityPolicy class
:rtype: ContentSecurityPolicy
"""
self._build(value)
return self
def custom_directive(
self, directive: str, *sources: str
) -> "ContentSecurityPolicy":
"""Set custom directive and sources
:param directive: custom directive
:type directive: str
:param sources: variable number of sources
:type sources: str
:return: ContentSecurityPolicy class
:rtype: ContentSecurityPolicy
"""
self._build(directive, *sources)
return self
def report_only(self) -> None:
"""Set Content-Security-Policy header to Content-Security-Policy-Report-Only"""
self.header = "Content-Security-Policy-Report-Only"
def base_uri(self, *sources: str) -> "ContentSecurityPolicy":
"""Sets valid origins for ``
Resources:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/base-uri
:param sources: variable number of sources
:type sources: str
:return: ContentSecurityPolicy class
:rtype: ContentSecurityPolicy
"""
self._build("base-uri", *sources)
return self
def child_src(self, *sources: str) -> "ContentSecurityPolicy":
"""Sets valid origins for web workers
Resources:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/child-src
:param sources: variable number of sources
:type sources: str
:return: ContentSecurityPolicy class
:rtype: ContentSecurityPolicy
"""
self._build("child-src", *sources)
return self
def connect_src(self, *sources: str) -> "ContentSecurityPolicy":
"""Sets valid origins for script interfaces
Resources:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src
:param sources: variable number of sources
:type sources: str
:return: ContentSecurityPolicy class
:rtype: ContentSecurityPolicy
"""
self._build("connect-src", *sources)
return self
def default_src(self, *sources: str) -> "ContentSecurityPolicy":
"""Sets fallback valid orgins for other directives
Resouces:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src
:param sources: variable number of sources
:type sources: str
:return: ContentSecurityPolicy class
:rtype: ContentSecurityPolicy
"""
self._build("default-src", *sources)
return self
def font_src(self, *sources: str) -> "ContentSecurityPolicy":
"""Set valid origins for `@font-face`
Resouces:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/font-src
:param sources: variable number of sources
:type sources: str
:return: ContentSecurityPolicy class
:rtype: ContentSecurityPolicy
"""
self._build("font-src", *sources)
return self
def form_action(self, *sources: str) -> "ContentSecurityPolicy":
"""Set valid origins for form submissions
Resouces:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/form-action
:param sources: variable number of sources
:type sources: str
:return: ContentSecurityPolicy class
:rtype: ContentSecurityPolicy
"""
self._build("form-action", *sources)
return self
def frame_ancestors(self, *sources: str) -> "ContentSecurityPolicy":
"""Set valid origins that can embed the resource
Resouces:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors
:param sources: variable number of sources
:type sources: str
:return: ContentSecurityPolicy class
:rtype: ContentSecurityPolicy
"""
self._build("frame-ancestors", *sources)
return self
def frame_src(self, *sources: str) -> "ContentSecurityPolicy":
"""Set valid origins for frames
Resouces:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-src
:param sources: variable number of sources
:type sources: str
:return: ContentSecurityPolicy class
:rtype: ContentSecurityPolicy
"""
self._build("frame-src", *sources)
return self
def img_src(self, *sources: str) -> "ContentSecurityPolicy":
"""Set valid origins for images
Resouces:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/img-src
:param sources: variable number of sources
:type sources: str
:return: ContentSecurityPolicy class
:rtype: ContentSecurityPolicy
"""
self._build("img-src", *sources)
return self
def manifest_src(self, *sources: str) -> "ContentSecurityPolicy":
"""Set valid origins for manifest files
Resouces:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/manifest-src
:param sources: variable number of sources
:type sources: str
:return: ContentSecurityPolicy class
:rtype: ContentSecurityPolicy
"""
self._build("manifest-src", *sources)
return self
def media_src(self, *sources: str) -> "ContentSecurityPolicy":
"""Set valid origins for media
Resouces:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/media-src
:param sources: variable number of sources
:type sources: str
:return: ContentSecurityPolicy class
:rtype: ContentSecurityPolicy
"""
self._build("media-src", *sources)
return self
def object_src(self, *sources: str) -> "ContentSecurityPolicy":
"""Set valid origins for plugins
Resouces:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/object-src
:param sources: variable number of sources
:type sources: str
:return: ContentSecurityPolicy class
:rtype: ContentSecurityPolicy
"""
self._build("object-src", *sources)
return self
def prefetch_src(self, *sources: str) -> "ContentSecurityPolicy":
"""Set valid resources that may prefetched or prerendered
Resouces:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/prefetch-src
:param sources: variable number of sources
:type sources: str
:return: ContentSecurityPolicy class
:rtype: ContentSecurityPolicy
"""
self._build("prefetch-src", *sources)
return self
def report_to(self, report_to: ReportTo) -> "ContentSecurityPolicy":
"""Configure reporting endpoints
Resouces:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-to
:param report_to: ReportTo class
:type report_to: ReportTo
:return: ContentSecurityPolicy class
:rtype: ContentSecurityPolicy
"""
self._build("report-to", report_to.value)
return self
def report_uri(self, *values: str) -> "ContentSecurityPolicy":
"""Configure reporting endpoints in an older format
**Deprecated**
This header has been deprecated in favor of report-to.
However, as it is not yet supported in most browsers, it is recommended to set both headers.
Browsers that support report-to will ignore report-uri if both headers are set.
Resouces:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-uri
:param values: variable number of URIs
:type values: str
:return: ContentSecurityPolicy class
:rtype: ContentSecurityPolicy
"""
self._build("report-uri", *values)
return self
def sandbox(self, *values: str) -> "ContentSecurityPolicy":
"""Enables sandbox restrictions
Resouces:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox
:param values: variable number of types
:type values: str
:return: ContentSecurityPolicy class
:rtype: ContentSecurityPolicy
"""
self._build("sandbox", *values)
return self
def script_src(self, *sources: str) -> "ContentSecurityPolicy":
"""Set valid origins for JavaScript
Resouces:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src
:param sources: variable number of types
:type sources: str
:return: ContentSecurityPolicy class
:rtype: ContentSecurityPolicy
"""
self._build("script-src", *sources)
return self
def style_src(self, *sources: str) -> "ContentSecurityPolicy":
"""Set valid origins for styles
Resouces:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src
:param sources: variable number of types
:type sources: str
:return: ContentSecurityPolicy class
:rtype: ContentSecurityPolicy
"""
self._build("style-src", *sources)
return self
def upgrade_insecure_requests(self) -> "ContentSecurityPolicy":
"""Upgrade HTTP URLs to HTTPS
Resouces:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-requests
:return: ContentSecurityPolicy class
:rtype: ContentSecurityPolicy
"""
self._build("upgrade-insecure-requests")
return self
def worker_src(self, *sources: str) -> "ContentSecurityPolicy":
"""Set valid origins for worker scripts
Resouces:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/worker-src
:param sources: variable number of types
:type sources: str
:return: ContentSecurityPolicy class
:rtype: ContentSecurityPolicy
"""
self._build("worker-src", *sources)
return self
@staticmethod
def nonce(value: str) -> str:
"""Creates a nonce format
:param value: nounce value
:type value: str
:return: ContentSecurityPolicy class
:rtype: ContentSecurityPolicy
"""
value = "'nonce-<{}>'".format(value)
return value
class XFrameOptions:
"""
Disable framing from different origins (clickjacking defense)
Resources:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
"""
def __init__(self) -> None:
self.header = "X-Frame-Options"
self.value = "SAMEORIGIN"
def set(self, value: str) -> "XFrameOptions":
"""Set custom value for X-Frame-Options header
:param value: custom header value
:type value: str
:return: XFrameOptions class
:rtype: XFrameOptions
"""
self.value = value
return self
def deny(self) -> "XFrameOptions":
"""Disable rending site in a frame
:return: XFrameOptions class
:rtype: XFrameOptions
"""
self.value = "deny"
return self
def sameorigin(self) -> "XFrameOptions":
"""Disable rending site in a frame if not same origin
:return: XFrameOptions class
:rtype: XFrameOptions
"""
self.value = "sameorigin"
return self
class XXSSProtection:
"""
Enable browser Cross-Site Scripting filters
**Deprecated**
Recommended to utilize `Content-Security-Policy`
instead of the legacy `X-XSS-Protection` header.
Resources:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
https://owasp.org/www-project-secure-headers/#x-xss-protection
"""
def __init__(self) -> None:
self.header = "X-XSS-Protection"
self.value = "0"
def set(self, value: str) -> "XXSSProtection":
"""Set custom value for `X-XSS-Protection` header
:param value: custom header value
:type value: str
:return: XXSSProtection class
:rtype: XXSSProtection
"""
warnings.warn(
"Recommended to utilize Content-Security-Policy",
DeprecationWarning,
)
self.value = value
return self
class ReferrerPolicy:
"""
Enable full referrer if same origin, remove path for cross origin and
disable referrer in unsupported browsers
Resources:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
https://owasp.org/www-project-secure-headers/#referrer-policy
"""
def __init__(self) -> None:
self.__policy: List[str] = []
self.header = "Referrer-Policy"
self.value = "no-referrer, strict-origin-when-cross-origin"
def _build(self, directive: str) -> None:
self.__policy.append(directive)
self.value = ", ".join(self.__policy)
def set(self, value: str) -> "ReferrerPolicy":
"""Set custom value for `Referrer-Policy` header
:param value: custom header value
:type value: str
:return: ReferrerPolicy class
:rtype: ReferrerPolicy
"""
self._build(value)
return self
def no_referrer(self) -> "ReferrerPolicy":
"""The `Referer` header will not be sent
:return: ReferrerPolicy class
:rtype: ReferrerPolicy
"""
self._build("no-referrer")
return self
def no_referrer_when_downgrade(self) -> "ReferrerPolicy":
"""The `Referer` header will not be sent if HTTPS -> HTTP
:return: ReferrerPolicy class
:rtype: ReferrerPolicy
"""
self._build("no-referrer-when-downgrade")
return self
def origin(self) -> "ReferrerPolicy":
"""The `Referer` header will contain only the origin
:return: ReferrerPolicy class
:rtype: ReferrerPolicy
"""
self._build("origin")
return self
def origin_when_cross_origin(self) -> "ReferrerPolicy":
"""The `Referer` header will contain the full URL
but only the origin if cross-origin
:return: ReferrerPolicy class
:rtype: ReferrerPolicy
"""
self._build("origin-when-cross-origin")
return self
def same_origin(self) -> "ReferrerPolicy":
"""The `Referer` header will be sent with the full URL if same-origin
:return: ReferrerPolicy class
:rtype: ReferrerPolicy
"""
self._build("same-origin")
return self
def strict_origin(self) -> "ReferrerPolicy":
"""The `Referer` header will be sent only for same-origin
:return: ReferrerPolicy class
:rtype: ReferrerPolicy
"""
self._build("strict-origin")
return self
def strict_origin_when_cross_origin(self) -> "ReferrerPolicy":
"""The `Referer` header will only contain the origin if HTTPS -> HTTP
:return: ReferrerPolicy class
:rtype: ReferrerPolicy
"""
self._build("strict-origin-when-cross-origin")
return self
def unsafe_url(self) -> "ReferrerPolicy":
"""The `Referer` header will contain the full URL
:return: ReferrerPolicy class
:rtype: ReferrerPolicy
"""
self._build("unsafe-url")
return self
class StrictTransportSecurity:
"""
Ensure application communication is sent over HTTPS
Resources:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
https://owasp.org/www-project-secure-headers/#http-strict-transport-security
"""
def __init__(self) -> None:
self.__policy: List[str] = []
self.header = "Strict-Transport-Security"
self.value = "max-age=63072000; includeSubdomains"
def _build(self, directive: str) -> None:
self.__policy.append(directive)
self.value = "; ".join(self.__policy)
def set(self, value: str) -> "StrictTransportSecurity":
"""Set custom value for `Strict-Transport-Security` header
:param value: custom header value
:type value: str
:return: StrictTransportSecurity class
:rtype: StrictTransportSecurity
"""
self._build(value)
return self
def include_subdomains(self) -> "StrictTransportSecurity":
"""Include subdomains to HSTS policy [Optional]
:return: [description]
:rtype: [type]
"""
self._build("includeSubDomains")
return self
def max_age(self, seconds: int) -> "StrictTransportSecurity":
"""Instruct the browser to remember HTTPS preference
until time (seconds) expires.
:param seconds: time in seconds
:type seconds: str
:return: StrictTransportSecurity class
:rtype: StrictTransportSecurity
"""
self._build("max-age={}".format(seconds))
return self
def preload(self) -> "StrictTransportSecurity":
"""Instruct browser to always use HTTPS [Optional]
Please see:
https://hstspreload.org
:return: StrictTransportSecurity class
:rtype: StrictTransportSecurity
"""
self._build("preload")
return self
class CacheControl:
"""
Prevent cacheable HTTPS response
Resources:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control
"""
def __init__(self) -> None:
self.__policy: List[str] = []
self.header = "Cache-Control"
self.value = "no-store"
def _build(self, directive: str) -> None:
self.__policy.append(directive)
self.value = ", ".join(self.__policy)
def set(self, value: str) -> "CacheControl":
"""Set custom value for `Cache-control` header
:param value: custom header value
:type value: str
:return: CacheControl class
:rtype: CacheControl
"""
self._build(value)
return self
def immutable(self) -> "CacheControl":
self._build("immutable")
return self
def max_age(self, seconds: int) -> "CacheControl":
self._build("max-age={}".format(seconds))
return self
def max_stale(self, seconds: int) -> "CacheControl":
self._build("max-stale={}".format(seconds))
return self
def min_fresh(self, seconds: int) -> "CacheControl":
self._build("min-fresh={}".format(seconds))
return self
def must_revalidate(self) -> "CacheControl":
self._build("must-revalidate")
return self
def no_cache(self) -> "CacheControl":
self._build("no-cache")
return self
def no_store(self) -> "CacheControl":
self._build("no-store")
return self
def no_transform(self) -> "CacheControl":
self._build("no-transform")
return self
def only_if_cached(self) -> "CacheControl":
self._build("only-if-cached")
return self
def private(self) -> "CacheControl":
self._build("private")
return self
def proxy_revalidate(self) -> "CacheControl":
self._build("proxy-revalidate")
return self
def public(self) -> "CacheControl":
self._build("public")
return self
def s_maxage(self, seconds: int) -> "CacheControl":
self._build("s-maxage={}".format(seconds))
return self
def stale_if_error(self, seconds: int) -> "CacheControl":
self._build("stale-if-error={}".format(seconds))
return self
def stale_while_revalidate(self, seconds: int) -> "CacheControl":
self._build("stale-while-revalidate={}".format(seconds))
return self
class PermissionsPolicy:
"""
Disable browser features and APIs
Replaces the `Feature-Policy` header
Resources:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy
https://github.com/w3c/webappsec-permissions-policy/blob/main/permissions-policy-explainer.md
"""
def __init__(self) -> None:
self.__policy: List[str] = []
self.header = "Permissions-Policy"
self.value = (
"accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), "
"camera=(), clipboard-read=(), clipboard-write=(), cross-origin-isolated=(), "
"display-capture=(), document-domain=(), encrypted-media=(), "
"execution-while-not-rendered=(), execution-while-out-of-viewport=(), "
"fullscreen=(), gamepad=(), geolocation=(), gyroscope=(), magnetometer=(), "
"microphone=(), midi=(), navigation-override=(), payment=(), "
"picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), "
"speaker-selection=(), sync-xhr=(), usb=(), web-share=(), "
"xr-spatial-tracking=()"
)
def _build(self, directive: str, *sources: str) -> None:
self.__policy.append(f"{directive}=({' '.join(sources)})")
self.value = ", ".join(self.__policy)
def set(self, value: str) -> "PermissionsPolicy":
self._build(value)
return self
def accelerometer(self, *allowlist: str) -> "PermissionsPolicy":
self._build("accelerometer", *allowlist)
return self
def ambient_light_sensor(self, *allowlist: str) -> "PermissionsPolicy":
self._build("ambient-light-sensor", *allowlist)
return self
def autoplay(self, *allowlist: str) -> "PermissionsPolicy":
self._build("autoplay", *allowlist)
return self
def battery(self, *allowlist: str) -> "PermissionsPolicy":
self._build("battery", *allowlist)
return self
def camera(self, *allowlist: str) -> "PermissionsPolicy":
self._build("camera", *allowlist)
return self
def clipboard_read(self, *allowlist: str) -> "PermissionsPolicy":
self._build("clipboard-read", *allowlist)
return self
def clipboard_write(self, *allowlist: str) -> "PermissionsPolicy":
self._build("clipboard-write", *allowlist)
return self
def cross_origin_isolated(self, *allowlist: str) -> "PermissionsPolicy":
self._build("cross-origin-isolated", *allowlist)
return self
def display_capture(self, *allowlist: str) -> "PermissionsPolicy":
self._build("display-capture", *allowlist)
return self
def document_domain(self, *allowlist: str) -> "PermissionsPolicy":
self._build("document-domain", *allowlist)
return self
def encrypted_media(self, *allowlist: str) -> "PermissionsPolicy":
self._build("encrypted-media", *allowlist)
return self
def execution_while_not_rendered(self, *allowlist: str) -> "PermissionsPolicy":
self._build("execution-while-not-rendered", *allowlist)
return self
def execution_while_out_of_viewport(self, *allowlist: str) -> "PermissionsPolicy":
self._build("execution-while-out-of-viewport", *allowlist)
return self
def fullscreen(self, *allowlist: str) -> "PermissionsPolicy":
self._build("fullscreen", *allowlist)
return self
def gamepad(self, *allowlist: str) -> "PermissionsPolicy":
self._build("gamepad", *allowlist)
return self
def geolocation(self, *allowlist: str) -> "PermissionsPolicy":
self._build("geolocation", *allowlist)
return self
def gyroscope(self, *allowlist: str) -> "PermissionsPolicy":
self._build("gyroscope", *allowlist)
return self
def magnetometer(self, *allowlist: str) -> "PermissionsPolicy":
self._build("magnetometer", *allowlist)
return self
def microphone(self, *allowlist: str) -> "PermissionsPolicy":
self._build("microphone", *allowlist)
return self
def midi(self, *allowlist: str) -> "PermissionsPolicy":
self._build("midi", *allowlist)
return self
def navigation_override(self, *allowlist: str) -> "PermissionsPolicy":
self._build("navigation-override", *allowlist)
return self
def payment(self, *allowlist: str) -> "PermissionsPolicy":
self._build("payment", *allowlist)
return self
def picture_in_picture(self, *allowlist: str) -> "PermissionsPolicy":
self._build("picture-in-picture", *allowlist)
return self
def publickey_credentials_get(self, *allowlist: str) -> "PermissionsPolicy":
self._build("publickey-credentials-get", *allowlist)
return self
def screen_wake_lock(self, *allowlist: str) -> "PermissionsPolicy":
self._build("screen-wake-lock", *allowlist)
return self
def speaker(self, *allowlist: str) -> "PermissionsPolicy":
warnings.warn(
"'speaker' feature was removed in favor of 'speaker_selection'",
DeprecationWarning,
)
self._build("speaker", *allowlist)
return self
def speaker_selection(self, *allowlist: str) -> "PermissionsPolicy":
self._build("speaker-selection", *allowlist)
return self
def sync_xhr(self, *allowlist: str) -> "PermissionsPolicy":
self._build("sync-xhr", *allowlist)
return self
def usb(self, *allowlist: str) -> "PermissionsPolicy":
self._build("usb", *allowlist)
return self
def web_share(self, *allowlist: str) -> "PermissionsPolicy":
self._build("web-share", *allowlist)
return self
def vibrate(self, *allowlist: str) -> "PermissionsPolicy":
warnings.warn(
"'vibrate' feature has been removed without ever actually having been implemented",
DeprecationWarning,
)
return self
def vr(self, *allowlist: str) -> "PermissionsPolicy":
warnings.warn(
"'vr' feature was renamed to 'xr_spatial_tracking'", DeprecationWarning
)
self._build("vr", *allowlist)
return self
def xr_spatial_tracking(self, *allowlist: str) -> "PermissionsPolicy":
self._build("xr-spatial-tracking", *allowlist)
return self
././@PaxHeader 0000000 0000000 0000000 00000000026 00000000000 010213 x ustar 00 22 mtime=1628725770.0
secure-0.3.0/secure/py.typed 0000644 0001745 0001745 00000000000 14105061012 015707 0 ustar 00janitor janitor ././@PaxHeader 0000000 0000000 0000000 00000000026 00000000000 010213 x ustar 00 22 mtime=1628725770.0
secure-0.3.0/secure/secure.py 0000644 0001745 0001745 00000017124 14105061012 016067 0 ustar 00janitor janitor from typing import Any, Dict, List, Optional, Tuple, Union
from .headers import (
CacheControl,
ContentSecurityPolicy,
PermissionsPolicy,
ReferrerPolicy,
ReportTo,
Server,
StrictTransportSecurity,
XContentTypeOptions,
XFrameOptions,
XXSSProtection,
)
class Secure:
"""Set Secure Header options
:param server: Server header options
:param hsts: Strict-Transport-Security (HSTS) header options
:param xfo: X-Frame-Options (XFO) header options
:param xxp: X-XSS-Protection (XXP) header options
:param content: X-Content-Type-Options header options
:param csp: Content-Security-Policy (CSP) header options
:param referrer: Referrer-Policy header options
:param cache: Cache-control, Pragma and Expires headers options
:param feature: Feature-Policy header options
"""
framework: "Framework"
def __init__(
self,
server: Optional[Server] = None,
hsts: Optional[StrictTransportSecurity] = StrictTransportSecurity(),
xfo: Optional[XFrameOptions] = XFrameOptions(),
xxp: Optional[XXSSProtection] = XXSSProtection(),
content: Optional[XContentTypeOptions] = XContentTypeOptions(),
csp: Optional[ContentSecurityPolicy] = None,
referrer: Optional[ReferrerPolicy] = ReferrerPolicy(),
cache: Optional[CacheControl] = CacheControl(),
permissions: Optional[PermissionsPolicy] = None,
report_to: Optional[ReportTo] = None,
) -> None:
self.server = server
self.hsts = hsts
self.xfo = xfo
self.xxp = xxp
self.content = content
self.csp = csp
self.referrer = referrer
self.cache = cache
self.permissions = permissions
self.report_to = report_to
self.framework = self.Framework(self)
def __repr__(self) -> str:
return "\n".join(
[f"{header}:{value}" for header, value in self.headers().items()]
)
def _header_list(
self,
) -> List[
Union[
CacheControl,
ContentSecurityPolicy,
PermissionsPolicy,
ReferrerPolicy,
ReportTo,
Server,
StrictTransportSecurity,
XContentTypeOptions,
XFrameOptions,
XXSSProtection,
]
]:
headers = [
self.server,
self.hsts,
self.xfo,
self.xxp,
self.content,
self.csp,
self.referrer,
self.cache,
self.permissions,
self.report_to,
]
return [header for header in headers if header is not None]
def headers(self) -> Dict[str, str]:
"""Dictionary of secure headers
:return: dictionary containing security headers
:rtype: Dict[str, str]
"""
headers: Dict[str, str] = {}
for header in self._header_list():
headers[header.header] = header.value
return headers
def headers_tuple(self) -> List[Tuple[str, str]]:
"""List of a tuple containing secure headers
:return: list of tuples containing security headers
:rtype: List[Tuple[str, str]]
"""
headers: List[Tuple[str, str]] = []
for header in self._header_list():
headers.append((header.header, header.value))
return headers
def _set_header_dict(self, response: Any) -> None:
for header in self._header_list():
response.headers[header.header] = header.value
def _set_header_tuple(self, response: Any) -> None:
for header in self._header_list():
response.set_header(header.header, header.value)
class Framework:
"""
Secure supported frameworks
"""
def __init__(self, secure: "Secure") -> None:
self.secure = secure
def aiohttp(self, response: Any) -> None:
"""Update Secure Headers to aiohttp response object.
:param response: aiohttp response object.
"""
self.secure._set_header_dict(response)
def bottle(self, response: Any) -> None:
"""Update Secure Headers to Bottle response object.
:param response: Bottle response object (bottle.response).
"""
self.secure._set_header_dict(response)
def cherrypy(self) -> List[Tuple[str, str]]:
"""Return tuple of Secure Headers for CherryPy (tools.response_headers.headers).
:return: A list with a tuple of Secure Headers.
"""
return self.secure.headers_tuple()
def django(self, response: Any) -> None:
"""Update Secure Headers to Django response object.
:param response: Django response object (django.http.HttpResponse)
"""
for header, value in self.secure.headers().items():
response[header] = value
def falcon(self, response: Any) -> None:
"""Update Secure Headers to Falcon response object.
:param response: Falcon response object (falcon.Response)
"""
self.secure._set_header_tuple(response)
def flask(self, response: Any) -> None:
"""Update Secure Headers to Flask response object.
:param response: Flask response object (flask.Response)
"""
self.secure._set_header_dict(response)
def fastapi(self, response: Any) -> None:
"""Update Secure Headers to FastAPI response object.
:param response: FastAPI response object.
"""
self.secure._set_header_dict(response)
def hug(self, response: Any) -> None:
"""Update Secure Headers to hug response object.
:param response: hug response object
"""
self.secure._set_header_tuple(response)
def masonite(self, request: Any) -> None:
"""Update Secure Headers to Masonite request object.
:param request: Masonite request object (masonite.request.Request)
"""
request.header(self.secure.headers())
def pyramid(self, response: Any) -> None:
"""Update Secure Headers to Pyramid response object.
:param response: Pyramid response object (pyramid.response).
"""
self.secure._set_header_dict(response)
def quart(self, response: Any) -> None:
"""Update Secure Headers to Quart response object.
:param response: Quart response object (quart.wrappers.response.Response)
"""
self.secure._set_header_dict(response)
def responder(self, response: Any) -> None:
"""Update Secure Headers to Responder response object.
:param response: Responder response object.
"""
self.secure._set_header_dict(response)
def sanic(self, response: Any) -> None:
"""Update Secure Headers to Sanic response object.
:param response: Sanic response object (sanic.response).
"""
self.secure._set_header_dict(response)
def starlette(self, response: Any) -> None:
"""Update Secure Headers to Starlette response object.
:param response: Starlette response object.
"""
self.secure._set_header_dict(response)
def tornado(self, response: Any) -> None:
"""Update Secure Headers to Tornado RequestHandler object.
:param response: Tornado RequestHandler object (tornado.web.RequestHandler).
"""
self.secure._set_header_tuple(response)
././@PaxHeader 0000000 0000000 0000000 00000000033 00000000000 010211 x ustar 00 27 mtime=1671787347.053118
secure-0.3.0/secure.egg-info/ 0000755 0001745 0001745 00000000000 14351271523 015731 5 ustar 00janitor janitor ././@PaxHeader 0000000 0000000 0000000 00000000026 00000000000 010213 x ustar 00 22 mtime=1671787347.0
secure-0.3.0/secure.egg-info/PKG-INFO 0000644 0001745 0001745 00000012562 14351271523 017034 0 ustar 00janitor janitor Metadata-Version: 2.1
Name: secure
Version: 0.3.0
Summary: A lightweight package that adds security headers for Python web frameworks.
Home-page: https://github.com/TypeError/secure
Author: Caleb Kinney
Author-email: caleb@derail.io
License: MIT
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.6
Classifier: Programming Language :: Python :: 3.7
Classifier: Programming Language :: Python :: 3.8
Classifier: Programming Language :: Python :: 3.9
Requires-Python: >=3.6
Description-Content-Type: text/markdown
License-File: LICENSE
# secure.py
[](https://pypi.org/project/secure/)
[](https://www.python.org/downloads/)
[](https://pypi.org/project/secure/)
[](https://github.com/psf/black)
[](https://travis-ci.org/TypeError/secure)
secure.py 🔒 is a lightweight package that adds optional security headers for Python web frameworks.
## Supported Python web frameworks
[aiohttp](https://docs.aiohttp.org), [Bottle](https://bottlepy.org), [CherryPy](https://cherrypy.org), [Django](https://www.djangoproject.com), [Falcon](https://falconframework.org), [FastAPI](https://fastapi.tiangolo.com), [Flask](http://flask.pocoo.org), [hug](http://www.hug.rest), [Masonite](https://docs.masoniteproject.com), [Pyramid](https://trypyramid.com), [Quart](https://pgjones.gitlab.io/quart/), [Responder](https://python-responder.org), [Sanic](https://sanicframework.org), [Starlette](https://www.starlette.io/), [Tornado](https://www.tornadoweb.org/)
## Install
**pip**:
```console
pip install secure
```
**Pipenv**:
```console
pipenv install secure
```
After installing secure:
```Python
import secure
secure_headers = secure.Secure()
```
## Secure Headers
### Example
`secure_headers.framework(response)`
**Default HTTP response headers:**
```HTTP
strict-transport-security: max-age=63072000; includeSubdomains
x-frame-options: SAMEORIGIN
x-xss-protection: 0
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
cache-control: no-store
```
## Policy Builders
### Policy Builder Example
**Content Security Policy builder:**
```python
csp = (
secure.ContentSecurityPolicy()
.default_src("'none'")
.base_uri("'self'")
.connect_src("'self'", "api.spam.com")
.frame_src("'none'")
.img_src("'self'", "static.spam.com")
)
secure_headers = secure.Secure(csp=csp)
```
**HTTP response headers:**
```HTTP
strict-transport-security: max-age=63072000; includeSubdomains
x-frame-options: SAMEORIGIN
x-xss-protection: 0
x-content-type-options: nosniff
referrer-policy: no-referrer, strict-origin-when-cross-origin
cache-control: no-store
content-security-policy: default-src 'none'; base-uri 'self'; connect-src 'self' api.spam.com; frame-src 'none'; img-src 'self' static.spam.com"
```
## Documentation
Please see the full set of documentation at [https://secure.readthedocs.io](https://secure.readthedocs.io)
## FastAPI Example
```python
import uvicorn
from fastapi import FastAPI
import secure
app = FastAPI()
server = secure.Server().set("Secure")
csp = (
secure.ContentSecurityPolicy()
.default_src("'none'")
.base_uri("'self'")
.connect_src("'self'" "api.spam.com")
.frame_src("'none'")
.img_src("'self'", "static.spam.com")
)
hsts = secure.StrictTransportSecurity().include_subdomains().preload().max_age(2592000)
referrer = secure.ReferrerPolicy().no_referrer()
permissions_value = (
secure.PermissionsPolicy().geolocation("self", "'spam.com'").vibrate()
)
cache_value = secure.CacheControl().must_revalidate()
secure_headers = secure.Secure(
server=server,
csp=csp,
hsts=hsts,
referrer=referrer,
permissions=permissions_value,
cache=cache_value,
)
@app.middleware("http")
async def set_secure_headers(request, call_next):
response = await call_next(request)
secure_headers.framework.fastapi(response)
return response
@app.get("/")
async def root():
return {"message": "Secure"}
if __name__ == "__main__":
uvicorn.run(app, port=8081, host="localhost")
```
**HTTP response headers:**
```HTTP
server: Secure
strict-transport-security: includeSubDomains; preload; max-age=2592000
x-frame-options: SAMEORIGIN
x-xss-protection: 0
x-content-type-options: nosniff
content-security-policy: default-src 'none'; base-uri 'self'; connect-src 'self'api.spam.com; frame-src 'none'; img-src 'self' static.spam.com
referrer-policy: no-referrer
cache-control: must-revalidate
permissions-policy: geolocation=(self 'spam.com'), vibrate=()
```
## Resources
- [kennethreitz/setup.py: 📦 A Human’s Ultimate Guide to setup.py.](https://github.com/kennethreitz/setup.py)
- [OWASP - Secure Headers Project](https://www.owasp.org/index.php/OWASP_Secure_Headers_Project)
- [Mozilla Web Security](https://infosec.mozilla.org/guidelines/web_security)
- [securityheaders.com](https://securityheaders.com)
- [MDN Web Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers#security)
- [web.dev](https://web.dev)
- [The World Wide Web Consortium (W3C)](https://www.w3.org)
././@PaxHeader 0000000 0000000 0000000 00000000026 00000000000 010213 x ustar 00 22 mtime=1671787347.0
secure-0.3.0/secure.egg-info/SOURCES.txt 0000644 0001745 0001745 00000000344 14351271523 017616 0 ustar 00janitor janitor LICENSE
MANIFEST.in
README.md
setup.py
secure/__init__.py
secure/headers.py
secure/py.typed
secure/secure.py
secure.egg-info/PKG-INFO
secure.egg-info/SOURCES.txt
secure.egg-info/dependency_links.txt
secure.egg-info/top_level.txt ././@PaxHeader 0000000 0000000 0000000 00000000026 00000000000 010213 x ustar 00 22 mtime=1671787347.0
secure-0.3.0/secure.egg-info/dependency_links.txt 0000644 0001745 0001745 00000000001 14351271523 021777 0 ustar 00janitor janitor
././@PaxHeader 0000000 0000000 0000000 00000000026 00000000000 010213 x ustar 00 22 mtime=1671787347.0
secure-0.3.0/secure.egg-info/top_level.txt 0000644 0001745 0001745 00000000007 14351271523 020460 0 ustar 00janitor janitor secure
././@PaxHeader 0000000 0000000 0000000 00000000033 00000000000 010211 x ustar 00 27 mtime=1671787347.053118
secure-0.3.0/setup.cfg 0000644 0001745 0001745 00000000046 14351271523 014572 0 ustar 00janitor janitor [egg_info]
tag_build =
tag_date = 0
././@PaxHeader 0000000 0000000 0000000 00000000026 00000000000 010213 x ustar 00 22 mtime=1628725770.0
secure-0.3.0/setup.py 0000644 0001745 0001745 00000011450 14105061012 014447 0 ustar 00janitor janitor #!/usr/bin/env python
# -*- coding: utf-8 -*-
# Note: To use the 'upload' functionality of this file, you must:
# $ pip install twine
# Credits:
# https://github.com/kennethreitz/setup.py
# Copyright
# Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
# The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
import io
import os
import sys
from shutil import rmtree
from setuptools import find_packages, setup, Command
# Package meta-data.
NAME = "secure"
DESCRIPTION = (
"A lightweight package that adds security headers for Python web frameworks."
)
URL = "https://github.com/TypeError/secure"
EMAIL = "caleb@derail.io"
AUTHOR = "Caleb Kinney"
REQUIRES_PYTHON = ">=3.6"
VERSION = "0.3.0"
# What packages are required for this module to be executed?
REQUIRED = [
# 'requests', 'maya', 'records',
]
# What packages are optional?
EXTRAS = {
# 'fancy feature': ['django'],
}
# The rest you shouldn't have to touch too much :)
# ------------------------------------------------
# Except, perhaps the License and Trove Classifiers!
# If you do change the License, remember to change the Trove Classifier for that!
here = os.path.abspath(os.path.dirname(__file__))
# Import the README and use it as the long-description.
# Note: this will only work if 'README.md' is present in your MANIFEST.in file!
try:
with io.open(os.path.join(here, "README.md"), encoding="utf-8") as f:
long_description = "\n" + f.read()
except FileNotFoundError:
long_description = DESCRIPTION
# Load the package's __version__.py module as a dictionary.
about = {}
if not VERSION:
with open(os.path.join(here, NAME, "__version__.py")) as f:
exec(f.read(), about)
else:
about["__version__"] = VERSION
class UploadCommand(Command):
"""Support setup.py upload."""
description = "Build and publish the package."
user_options = []
@staticmethod
def status(s):
"""Prints things in bold."""
print("\033[1m{0}\033[0m".format(s))
def initialize_options(self):
pass
def finalize_options(self):
pass
def run(self):
try:
self.status("Removing previous builds…")
rmtree(os.path.join(here, "dist"))
except OSError:
pass
self.status("Building Source and Wheel (universal) distribution…")
os.system("{0} setup.py sdist bdist_wheel --universal".format(sys.executable))
self.status("Uploading the package to PyPI via Twine…")
os.system("twine upload dist/*")
self.status("Pushing git tags…")
os.system("git tag v{0}".format(about["__version__"]))
os.system("git push --tags")
sys.exit()
# Where the magic happens:
setup(
name=NAME,
version=about["__version__"],
description=DESCRIPTION,
long_description=long_description,
long_description_content_type="text/markdown",
author=AUTHOR,
author_email=EMAIL,
python_requires=REQUIRES_PYTHON,
url=URL,
packages=find_packages(exclude=("tests",)),
# If your package is a single module, use this instead of 'packages':
# py_modules=['mypackage'],
# entry_points={
# 'console_scripts': ['mycli=mymodule:cli'],
# },
install_requires=REQUIRED,
extras_require=EXTRAS,
include_package_data=True,
package_data={
"secure": ["*.pyi", "py.typed"],
},
license="MIT",
classifiers=[
# Trove classifiers
# Full list: https://pypi.python.org/pypi?%3Aaction=list_classifiers
"License :: OSI Approved :: MIT License",
"Programming Language :: Python",
"Programming Language :: Python :: 3",
"Programming Language :: Python :: 3.6",
"Programming Language :: Python :: 3.7",
"Programming Language :: Python :: 3.8",
"Programming Language :: Python :: 3.9",
],
# $ setup.py publish support.
cmdclass={
"upload": UploadCommand,
},
)