gitea-admin/gh-christianlouis-docuelevate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: change security headers default to disabled

Browse Source 
Security headers are now disabled by default since most deployments use a reverse proxy (Traefik, Nginx) that already adds these headers. Enable with SECURITY_HEADERS_ENABLED=true for direct deployments.

Changes:
- Set security_headers_enabled default to False in app/config.py
- Update all documentation to reflect new default
- Comment out examples in .env.demo (now showing disabled state)
- Update SECURITY_AUDIT.md to reflect reverse proxy as default deployment
- Tests still pass (3 passed, 8 skipped as expected with headers disabled)

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-02-10 14:22:47 +00:00
parent 20a0e43a11
commit 956f0c0c2a
5 changed files with 77 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.demo
+11 -10
View File
@@ -22,29 +22,30 @@ MAX_UPLOAD_SIZE=1073741824
# MAX_SINGLE_FILE_SIZE=104857600
# **Security Headers** (see SECURITY_AUDIT.md and docs/DeploymentGuide.md)
# Enable security headers middleware in the application
# Set to false if deploying behind a reverse proxy (Traefik, Nginx, etc.) that already adds these headers
SECURITY_HEADERS_ENABLED=true
# Disabled by default since most deployments use a reverse proxy (Traefik, Nginx, etc.)
# that already adds these headers. Set to true only if deploying directly without a reverse proxy.
# SECURITY_HEADERS_ENABLED=false
# If you enable security headers, you can also configure individual headers:
# Strict-Transport-Security (HSTS) - Forces HTTPS connections
# Only effective when served over HTTPS. Disable if not using HTTPS or if proxy adds this header
SECURITY_HEADER_HSTS_ENABLED=true
SECURITY_HEADER_HSTS_VALUE="max-age=31536000; includeSubDomains"
# SECURITY_HEADER_HSTS_ENABLED=true
# SECURITY_HEADER_HSTS_VALUE="max-age=31536000; includeSubDomains"
# Content-Security-Policy (CSP) - Controls resource loading
# Customize based on your application's resource loading needs
# Default allows self-hosted resources, inline scripts/styles, and external images
SECURITY_HEADER_CSP_ENABLED=true
SECURITY_HEADER_CSP_VALUE="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:;"
# SECURITY_HEADER_CSP_ENABLED=true
# SECURITY_HEADER_CSP_VALUE="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:;"
# X-Frame-Options - Prevents clickjacking attacks
# Options: DENY (no framing), SAMEORIGIN (same origin framing only), ALLOW-FROM uri
SECURITY_HEADER_X_FRAME_OPTIONS_ENABLED=true
SECURITY_HEADER_X_FRAME_OPTIONS_VALUE="DENY"
# SECURITY_HEADER_X_FRAME_OPTIONS_ENABLED=true
# SECURITY_HEADER_X_FRAME_OPTIONS_VALUE="DENY"
# X-Content-Type-Options - Prevents MIME sniffing
# Always set to 'nosniff' when enabled
SECURITY_HEADER_X_CONTENT_TYPE_OPTIONS_ENABLED=true
# SECURITY_HEADER_X_CONTENT_TYPE_OPTIONS_ENABLED=true
# **Authentication**
AUTH_ENABLED=true