gitea-admin/gh-christianlouis-docuelevate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(security): add configurable security headers middleware

Browse Source 
- Add SecurityHeadersMiddleware with HSTS, CSP, X-Frame-Options, X-Content-Type-Options
- Add configuration options in app/config.py
- Integrate middleware into app/main.py
- Add comprehensive tests in tests/test_security_headers.py
- Update .env.demo with security header examples
- Update docs/DeploymentGuide.md with security headers section and Traefik/Nginx examples
- Update docs/ConfigurationGuide.md with detailed configuration reference
- Update SECURITY_AUDIT.md to mark security headers implementation complete

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-02-10 14:05:19 +00:00
parent ec44cb082e
commit e144fdd50a
9 changed files with 870 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.demo
+25
View File
@@ -21,6 +21,31 @@ MAX_UPLOAD_SIZE=1073741824
# Default: None (no splitting). Example: 104857600 for 100MB chunks
# MAX_SINGLE_FILE_SIZE=104857600
# **Security Headers** (see SECURITY_AUDIT.md and docs/DeploymentGuide.md)
# Enable security headers middleware in the application
# Set to false if deploying behind a reverse proxy (Traefik, Nginx, etc.) that already adds these headers
SECURITY_HEADERS_ENABLED=true
# Strict-Transport-Security (HSTS) - Forces HTTPS connections
# Only effective when served over HTTPS. Disable if not using HTTPS or if proxy adds this header
SECURITY_HEADER_HSTS_ENABLED=true
SECURITY_HEADER_HSTS_VALUE="max-age=31536000; includeSubDomains"
# Content-Security-Policy (CSP) - Controls resource loading
# Customize based on your application's resource loading needs
# Default allows self-hosted resources, inline scripts/styles, and external images
SECURITY_HEADER_CSP_ENABLED=true
SECURITY_HEADER_CSP_VALUE="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:;"
# X-Frame-Options - Prevents clickjacking attacks
# Options: DENY (no framing), SAMEORIGIN (same origin framing only), ALLOW-FROM uri
SECURITY_HEADER_X_FRAME_OPTIONS_ENABLED=true
SECURITY_HEADER_X_FRAME_OPTIONS_VALUE="DENY"
# X-Content-Type-Options - Prevents MIME sniffing
# Always set to 'nosniff' when enabled
SECURITY_HEADER_X_CONTENT_TYPE_OPTIONS_ENABLED=true
# **Authentication**
AUTH_ENABLED=true
# Generate a secure random string, for example: