06/01 App enhanced

app/__init__.py

@@ -116,6 +116,16 @@ def create_app(config_name=None):
         )
         from app.models.teller_enrollment import TellerEnrollment, TellerAccount
 
+    @app.after_request
+    def security_headers(response):
+        response.headers['X-Frame-Options'] = 'DENY'
+        response.headers['X-Content-Type-Options'] = 'nosniff'
+        response.headers['X-XSS-Protection'] = '1; mode=block'
+        response.headers['Referrer-Policy'] = 'strict-origin-when-cross-origin'
+        if not app.debug:
+            response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
+        return response
+
     app.jinja_env.globals['format_currency'] = format_currency
     app.jinja_env.globals['format_percent'] = format_percent
     app.jinja_env.globals['format_large_number'] = format_large_number