July 4 - Update security

app/__init__.py

@@ -267,6 +267,7 @@ def create_app(config_name='default'):
     # obvious XSS vectors without breaking Bootstrap CDN / Google Fonts.
     @app.after_request
     def set_security_headers(response):
+        from flask import request as _request
         response.headers.setdefault('X-Content-Type-Options', 'nosniff')
         response.headers.setdefault('X-Frame-Options', 'SAMEORIGIN')
         response.headers.setdefault('Referrer-Policy', 'strict-origin-when-cross-origin')
@@ -279,8 +280,17 @@ def create_app(config_name='default'):
             "img-src 'self' data: blob: https://maps.gstatic.com https://maps.googleapis.com; "
             "connect-src 'self' https://cdn.jsdelivr.net; "
             "frame-src https://maps.google.com https://www.google.com; "
+            # Hardening directives that don't affect existing inline scripts/styles:
+            # block plugins, injected <base> tags, and cross-origin form posts.
+            "object-src 'none'; base-uri 'self'; form-action 'self'; "
             "frame-ancestors 'none';"
         )
+        # HSTS — advertise only over HTTPS (Nginx terminates TLS and forwards
+        # X-Forwarded-Proto). includeSubDomains is deliberately OMITTED: a tenant
+        # custom domain may run unrelated subdomains that are not yet HTTPS, and
+        # this header must never force-upgrade one of those.
+        if _request.is_secure or _request.headers.get('X-Forwarded-Proto', '') == 'https':
+            response.headers.setdefault('Strict-Transport-Security', 'max-age=31536000')
         return response
 
     # ── Error handler: 413 Request Entity Too Large ───────────────────────