Jul 20 - Update codes to comply with some framework (SOC 2 TYPE 2, ISO, etc)

app/__init__.py

@@ -1,4 +1,4 @@
-from flask import Flask
+from flask import Flask, request
 from flask_sqlalchemy import SQLAlchemy
 from flask_login import LoginManager
 from flask_migrate import Migrate
@@ -251,6 +251,13 @@ def create_app(config_name='default'):
         response.headers.setdefault('X-Content-Type-Options', 'nosniff')
         response.headers.setdefault('X-Frame-Options', 'SAMEORIGIN')
         response.headers.setdefault('Referrer-Policy', 'strict-origin-when-cross-origin')
+        # Only asserted over an actual HTTPS request — ProxyFix (x_proto=1) makes
+        # request.is_secure reflect the real client-facing scheme behind Nginx,
+        # so this never fires for plain-HTTP local/dev requests.
+        if request.is_secure:
+            response.headers.setdefault(
+                'Strict-Transport-Security', 'max-age=31536000; includeSubDomains'
+            )
         response.headers.setdefault(
             'Content-Security-Policy',
             "default-src 'self'; "