04/18 Enhance app (security, performance)

app/__init__.py

@@ -26,7 +26,39 @@ def create_app(config_name: str = 'development') -> Flask:
     login_manager.init_app(app)
     csrf.init_app(app)
     limiter.init_app(app)
-    CORS(app, resources={r'/api/*': {'origins': '*'}})
+
+    # Restrict CORS to the configured origin (locked to production domain in prod)
+    cors_origins = app.config.get('CORS_ORIGINS', '*')
+    CORS(app, resources={r'/api/*': {'origins': cors_origins}})
+
+    # Attach security headers to every response
+    @app.after_request
+    def set_security_headers(response):
+        # Strict-Transport-Security: enforce HTTPS for 1 year, include subdomains
+        response.headers['Strict-Transport-Security'] = (
+            'max-age=31536000; includeSubDomains'
+        )
+        # Prevent clickjacking
+        response.headers['X-Frame-Options'] = 'DENY'
+        # Prevent MIME-type sniffing
+        response.headers['X-Content-Type-Options'] = 'nosniff'
+        # Control referrer information leakage
+        response.headers['Referrer-Policy'] = 'strict-origin-when-cross-origin'
+        # Permissions policy — disable features the app does not use
+        response.headers['Permissions-Policy'] = (
+            'geolocation=(), camera=(), microphone=()'
+        )
+        # CSP via HTTP header (authoritative — overrides the meta tag for all resources)
+        response.headers['Content-Security-Policy'] = (
+            "default-src 'self'; "
+            "script-src 'self'; "
+            "style-src 'self'; "
+            "img-src 'self' data:; "
+            "font-src 'self'; "
+            "connect-src 'self'; "
+            "frame-ancestors 'none';"
+        )
+        return response
 
     # Ensure all models are imported so SQLAlchemy knows about them
     from .models.user import User