05/22 Enhance codes and fix bugs

2026-05-22 11:53:41 -04:00
parent d6d9b5e9dc
commit 3511ac2b56
13 changed files with 891 additions and 47 deletions
@@ -182,6 +182,16 @@ def create_app(config_name=None):
        return dict(unread_notifications=unread, branding=branding,
                    now_local=now_local, app_tz_name=_tz_name)

+    # ── Security headers ──────────────────────────────────────────────────────
+    @app.after_request
+    def set_security_headers(response):
+        response.headers.setdefault('X-Frame-Options', 'SAMEORIGIN')
+        response.headers.setdefault('X-Content-Type-Options', 'nosniff')
+        response.headers.setdefault('Referrer-Policy', 'strict-origin-when-cross-origin')
+        response.headers.setdefault('X-XSS-Protection', '1; mode=block')
+        response.headers.setdefault('Permissions-Policy', 'geolocation=(), microphone=(), camera=()')
+        return response
+
    # ── DB initialisation (first run) ─────────────────────────────────────────
    with app.app_context():
        db.create_all()