<p align = "center"><img alt="Secweb logo" src="https://raw.githubusercontent.com/tmotagam/Secweb/main/Secweb.jpg"></p>
<p align="center"><em>Secweb helps in setting security headers for FastApi and Starlette</em></p>
---
Secweb is the pack of middlewares for setting security headers for fastapi and can also be used for any framework created on starlette it has 16 middlewares for setting headers of your website and also for your api(s).
## **Features**
- 🔒 **Secure Headers**: Automatically apply headers like `Strict-Transport-Security`, `Content-Security-Policy`, and more.
- 🛠️ **Customizable Policies**: Flexibly build your own security policies.
- 🚀 **No External Dependencies**: Lightweight and easy to include in any project that uses **FastAPI** and **Starlette**.
- 🧩 **Easy to Use**: Integrate security headers in just a few lines of code.
- 📚 **Attribution to Trusted Sources**: Implements recommendations from MDN and OWASP.
**The PermissionsPolicy middleware lies in development branch [here](https://github.com/tmotagam/Secweb/tree/Secweb-Beta#readme)**
The list of middleware is as follows:
1. Content Security Policy (CSP)
<br>
2. Origin Agent Cluster
<br>
3. Referrer Policy
<br>
4. HTTP Strict Transport Security(HSTS)
<br>
5. HTTP Strict Transport Security(HSTS) for WebSockets
<br>
6. X-Content-Type-Options
<br>
7. X-DNS-Prefetch-Control
<br>
8. X-Download-Options
<br>
9. X-Frame
<br>
10. X-Permitted-Cross-Domain-Policies
<br>
11. X-XSS-Protection
<br>
12. Cross-Origin-Embedder-Policy
<br>
13. Cross-Origin-Opener-Policy
<br>
14. Cross-Origin-Resource-Policy
<br>
15. Clear-Site-Data
<br>
16. Cache-Control
# Requirements
* [Python >= 3.8](https://www.python.org/downloads/)
* [Starlette](https://pypi.org/project/starlette/)
# Installation
```powershell
pip install Secweb
```
# Usage
The package Secweb can be used in two different ways:
1. Use the SecWeb class - it includes all the 16 classes together
<br>
2. Use the 16 middleware classes separately
## SecWeb class
```Python
from Secweb import SecWeb
SecWeb(app=app) # The app is the ASGIapp required by the starlette to give access to the different methods to the class
```
The above example uses all the default headers value that are preset. You can change the values by creating the option dict.
You can also set flags for nonce generation for csp header using the `script_nonce=True` and `style_nonce=True` flags. The `report_only` flag is added for csp report only header. For Clear-Site-Data header `Routes=[]` array is used for applying the header, it is empty by default.
```Python
from Secweb import SecWeb
SecWeb(app=app, Option={'referrer': ['no-referrer']}, Routes=[], script_nonce=False, style_nonce=False, report_only=False)
```
The `Option`-parameter uses 16 keys for calling middleware classes to set the user-defined policies or activating or deactivating headers.
**Note: Activating/Deactivating the header can only be done in SecWeb class in Option param**
```Python
from Secweb import SecWeb
Secweb(app=app, Option={'referrer': False, 'xframe': False})
```
The values are as follows:
1. `'csp'` for calling ContentSecurityPolicy class to set the user-defined values or activate/deactivate the header
<br>
2. `'referrer'` for calling ReferrerPolicy class to set the user-defined values or activate/deactivate the header
<br>
3. `'xdns'` for calling XDNSPrefetchControl class to set the user-defined values or activate/deactivate the header
<br>
4. `'xcdp'` for calling XPermittedCrossDomainPolicies class to set the user-defined values or activate/deactivate the header
<br>
5. `'hsts'` for calling HSTS class to set the user-defined values or activate/deactivate the header
<br>
6. `'wshsts'` for calling WsHSTS class to set the user-defined values for Websockets or activate/deactivate the header
<br>
7. `'xframe'` for calling XFrame class to set the user-defined values or activate/deactivate the header
<br>
8. `'coep'` for calling CrossOriginEmbedderPolicy class to set the user-defined values or activate/deactivate the header
<br>
9. `'coop'` for calling CrossOriginOpenerPolicy class to set the user-defined values or activate/deactivate the header
<br>
10. `'corp'` for calling CrossOriginResourcePolicy class to set the user-defined values or activate/deactivate the header
<br>
11. `'clearSiteData'` for calling ClearSiteData class to set the user-defined values or activate/deactivate the header
<br>
12. `'cacheControl'` for calling CacheControl class to set the user-defined values or activate/deactivate the header
<br>
13. `'xcto'` for activating/deactivating X-Content-Type-Options header
<br>
14. `'xdo'` for activating/deactivating X-Download-Options header
<br>
15. `'xss'` for activating/deactivating x-xss-protection header
<br>
16. `'oac'` for activating/deactivating Origin-Agent-Cluster header
```python
# Example of all values
SecWeb(app=app, Option={'csp': {'default-src': ["'self'"]}, 'xframe':'SAMEORIGIN', 'hsts': {'max-age': 4, 'preload': True}, 'wshsts': {'max-age': 10, 'preload': True},'xcdp': 'all', 'xdns': 'on', 'referrer': ['no-referrer'], 'coep':'require-corp', 'coop':'same-origin-allow-popups', 'corp': 'same-site', 'clearSiteData': {'cache': True, 'storage': True}, 'cacheControl': {'public': True, 's-maxage': 600}, 'xss': False}, Routes=['/login/{id}', '/logout/{id:uuid}/username/{username:string}'])
```
## Middleware Classes
### Content Security Policy (CSP)
#### Nonce Processor
The Nonce_Processor module generates nonce for csp header
```python
# Some Code
nonce = Nonce_Processor(DEFAULT_ENTROPY=90) # inject the nonce variable into the jinja or html
# Some Code
```
`DEFAULT_ENTROPY` is used to set the nonce length.
The nonce processor needs to be called on the route the following example is of FastApi calling the nonce processor on the route
```python
from fastapi import FastAPI
from Secweb.ContentSecurityPolicy import Nonce_Processor
app = FastAPI()
@app.get("/")
async def root():
# some code
nonce = Nonce_Processor(DEFAULT_ENTROPY=90) # inject the nonce variable into the jinja or html
# some more code
```
ContentSecurityPolicy class sets the csp header.
#### For FastApi server
```python
from fastapi import FastAPI
from Secweb.ContentSecurityPolicy import ContentSecurityPolicy
app = FastAPI()
app.add_middleware(ContentSecurityPolicy, Option={'default-src': ["'self'"], 'base-uri': ["'self'"], 'block-all-mixed-content': []}, script_nonce=False, style_nonce=False, report_only=False)
```
#### For Starlette server
```python
from starlette.applications import Starlette
from Secweb.ContentSecurityPolicy import ContentSecurityPolicy
app = Starlette()
app.add_middleware(ContentSecurityPolicy, Option={'default-src': ["'self'"], 'base-uri': ["'self'"], 'block-all-mixed-content': []}, script_nonce=False, style_nonce=False, report_only=False)
```
* `script_nonce=False`: nonce flag for inline Javascript
* `style_nonce=False`: nonce flag for inline css
* `report_only=False`: report only flag which makes csp report only header
For more detail on CSP header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy).
For more detail on CSP-report-only header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only).
### Origin Agent Cluster
OriginAgentCluster class sets the Origin-Agent-Cluster header. It takes no parameters.
#### For FastApi server
```python
from fastapi import FastAPI
from Secweb.OriginAgentCluster import OriginAgentCluster
app = FastAPI()
app.add_middleware(OriginAgentCluster)
```
#### For Starlette server
```python
from starlette.applications import Starlette
from Secweb.OriginAgentCluster import OriginAgentCluster
app = Starlette()
app.add_middleware(OriginAgentCluster)
```
For more detail on Origin-Agent-Cluster header go to [WHATWG Site](https://html.spec.whatwg.org/multipage/origin.html#origin-keyed-agent-clusters).
### Referrer Policy
ReferrerPolicy class sets the Referrer-Policy header
#### For FastApi server
```python
from fastapi import FastAPI
from Secweb.ReferrerPolicy import ReferrerPolicy
app = FastAPI()
app.add_middleware(ReferrerPolicy, Option=['strict-origin-when-cross-origin'])
```
#### For Starlette server
```python
from starlette.applications import Starlette
from Secweb.ReferrerPolicy import ReferrerPolicy
app = Starlette()
app.add_middleware(ReferrerPolicy, Option=['strict-origin-when-cross-origin'])
```
For more detail on Referrer-Policy header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy).
### HTTP Strict Transport Security (HSTS)
HSTS class sets the Strict-Transport-Security header
#### For FastApi server
```python
from fastapi import FastAPI
from Secweb.StrictTransportSecurity import HSTS
app = FastAPI()
app.add_middleware(HSTS, Option={'max-age': 4, 'preload': True})
```
#### For Starlette server
```python
from starlette.applications import Starlette
from Secweb.StrictTransportSecurity import HSTS
app = Starlette()
app.add_middleware(HSTS, Option={'max-age': 4, 'preload': True})
```
For more detail on Strict-Transport-Security header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security).
### HTTP Strict Transport Security (HSTS) for WebSockets
HSTS class sets the Strict-Transport-Security header for Websockets
#### For FastApi server
```python
from fastapi import FastAPI
from Secweb.WsStrictTransportSecurity import WsHSTS
app = FastAPI()
app.add_middleware(WsHSTS, Option={'max-age': 4, 'preload': True})
```
#### For Starlette server
```python
from starlette.applications import Starlette
from Secweb.WsStrictTransportSecurity import WsHSTS
app = Starlette()
app.add_middleware(WsHSTS, Option={'max-age': 4, 'preload': True})
```
For more detail on Strict-Transport-Security header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security).
### X-Content-Type-Options
XContentTypeOptions class sets the X-Content-Type-Options header the class takes no parameters
#### For FastApi server
```python
from fastapi import FastAPI
from Secweb.XContentTypeOptions import XContentTypeOptions
app = FastAPI()
app.add_middleware(XContentTypeOptions)
```
#### For Starlette server
```python
from starlette.applications import Starlette
from Secweb.XContentTypeOptions import XContentTypeOptions
app = Starlette()
app.add_middleware(XContentTypeOptions)
```
For more detail on X-Content-Type-Options header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options).
### X-DNS-Prefetch-Control
XDNSPrefetchControl class sets the X-DNS-Prefetch-Control header
#### For FastApi server
```python
from fastapi import FastAPI
from Secweb.XDNSPrefetchControl import XDNSPrefetchControl
app = FastAPI()
app.add_middleware(XDNSPrefetchControl, Option='on')
```
#### For Starlette server
```python
from starlette.applications import Starlette
from Secweb.XDNSPrefetchControl import XDNSPrefetchControl
app = Starlette()
app.add_middleware(XDNSPrefetchControl, Option='off')
```
For more detail on X-DNS-Prefetch-Control header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control).
### X-Download-Options
XDownloadOptions class sets the X-Download-Options header the class takes no parameter
#### For FastApi server
```python
from fastapi import FastAPI
from Secweb.XDownloadOptions import XDownloadOptions
app = FastAPI()
app.add_middleware(XDownloadOptions)
```
#### For Starlette server
```python
from starlette.applications import Starlette
from Secweb.XDownloadOptions import XDownloadOptions
app = Starlette()
app.add_middleware(XDownloadOptions)
```
### X-Frame
XFrame class sets the X-Frame-Options header
#### For FastApi server
```python
from fastapi import FastAPI
from Secweb.XFrameOptions import XFrame
app = FastAPI()
app.add_middleware(XFrame, Option='DENY')
```
#### For Starlette server
```python
from starlette.applications import Starlette
from Secweb.XFrameOptions import XFrame
app = Starlette()
app.add_middleware(XFrame, Option='DENY')
```
For more detail on X-Frame-Options header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options).
### X-Permitted-Cross-Domain-Policies
XPermittedCrossDomainPolicies class sets the X-Permitted-Cross-Domain-Policies header
#### For FastApi server
```python
from fastapi import FastAPI
from Secweb.XPermittedCrossDomainPolicies import XPermittedCrossDomainPolicies
app = FastAPI()
app.add_middleware(XPermittedCrossDomainPolicies, Option='none')
```
#### For Starlette server
```python
from starlette.applications import Starlette
from Secweb.XPermittedCrossDomainPolicies import XPermittedCrossDomainPolicies
app = Starlette()
app.add_middleware(XPermittedCrossDomainPolicies, Option='none')
```
For more detail on X-Permitted-Cross-Domain-Policies header go to [OWASP Site](https://owasp.org/www-project-secure-headers/#x-permitted-cross-domain-policies).
### X-XSS-Protection
xXSSProtection class sets the X-XSS-Protection header the class takes no parameter
#### For FastApi server
```python
from fastapi import FastAPI
from Secweb.xXSSProtection import xXSSProtection
app = FastAPI()
app.add_middleware(xXSSProtection)
```
#### For Starlette server
```python
from starlette.applications import Starlette
from Secweb.xXSSProtection import xXSSProtection
app = Starlette()
app.add_middleware(xXSSProtection)
```
For more detail on X-XSS-Protection header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection).
### Cross Origin Embedder Policy
CrossOriginEmbedderPolicy class sets the Cross Origin Embedder Policy header
#### For FastApi server
```python
from fastapi import FastAPI
from Secweb.CrossOriginEmbedderPolicy import CrossOriginEmbedderPolicy
app = FastAPI()
app.add_middleware(CrossOriginEmbedderPolicy, Option='unsafe-none')
```
#### For Starlette server
```python
from starlette.applications import Starlette
from Secweb.CrossOriginEmbedderPolicy import CrossOriginEmbedderPolicy
app = Starlette()
app.add_middleware(CrossOriginEmbedderPolicy, Option='unsafe-none')
```
For more detail on Cross Origin Embedder Policy header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy).
### Cross Origin Opener Policy
CrossOriginOpenerPolicy class sets the Cross Origin Opener Policy header
#### For FastApi server
```python
from fastapi import FastAPI
from Secweb.CrossOriginOpenerPolicy import CrossOriginOpenerPolicy
app = FastAPI()
app.add_middleware(CrossOriginOpenerPolicy, Option='unsafe-none')
```
#### For Starlette server
```python
from starlette.applications import Starlette
from Secweb.CrossOriginOpenerPolicy import CrossOriginOpenerPolicy
app = Starlette()
app.add_middleware(CrossOriginOpenerPolicy, Option='unsafe-none')
```
For more detail on Cross Origin Opener Policy header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy).
### Cross Origin Resource Policy
CrossOriginResourcePolicy class sets the Cross Origin Resource Policy header
#### For FastApi server
```python
from fastapi import FastAPI
from Secweb.CrossOriginResourcePolicy import CrossOriginResourcePolicy
app = FastAPI()
app.add_middleware(CrossOriginResourcePolicy, Option='same-site')
```
#### For Starlette server
```python
from starlette.applications import Starlette
from Secweb.CrossOriginResourcePolicy import CrossOriginResourcePolicy
app = Starlette()
app.add_middleware(CrossOriginResourcePolicy, Option='same-site')
```
For more detail on Cross Origin Resource Policy header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy).
### Clear Site Data
ClearSiteData class sets the Clear-Site-Data header. In this class the routes array is compulsory so that the header can only be applied to the specified route as it clears every data on the users browser you can add static, dynamic routes like shown below.
#### For FastApi server
```python
from fastapi import FastAPI
from Secweb.ClearSiteData import ClearSiteData
app = FastAPI()
app.add_middleware(ClearSiteData, Option={'cookies': True}, Routes=['/login', '/logout/{id}'])
```
#### For Starlette server
```python
from starlette.applications import Starlette
from Secweb.ClearSiteData import ClearSiteData
app = Starlette()
app.add_middleware(ClearSiteData, Option={'cookies': True}, Routes=['/login', '/logout/{id}'])
```
For more detail on Clear Site Data Header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data).
### Cache Control
CacheControl class sets the Cache-Control header. This is useful for controlling cached data on user`s browser
#### For FastApi server
```python
from fastapi import FastAPI
from Secweb.CacheControl import CacheControl
app = FastAPI()
app.add_middleware(CacheControl, Option={'s-maxage': 600, 'public': True})
```
#### For Starlette server
```python
from starlette.applications import Starlette
from Secweb.CacheControl import CacheControl
app = Starlette()
app.add_middleware(CacheControl, Option={'s-maxage': 600, 'public': True})
```
For more detail on Cache Control Header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control).
# Contributing
Pull requests and Issues are welcome. For major changes, please open an issue first to discuss what you would like to change.
**[Github](https://github.com/tmotagam/Secweb)**
# License
**[MLP 2.0](https://www.mozilla.org/en-US/MPL/2.0/)**
# Secweb Icon
**[Secweb Icon](https://github.com/tmotagam/Secweb/blob/main/Secweb.jpg) © 2021 - 2025 by [Motagamwala Taha Arif Ali](https://github.com/tmotagam) is licensed under [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/?ref=chooser-v1)**
Raw data
{
"_id": null,
"home_page": null,
"name": "Secweb",
"maintainer": null,
"docs_url": null,
"requires_python": ">=3.8",
"maintainer_email": null,
"keywords": "fastapi security header, security header, starlette security header, secweb, fastapi csp, starlette csp, csp",
"author": null,
"author_email": "Motagamwala Taha Arif Ali <tahaar5321@gmail.com>",
"download_url": "https://files.pythonhosted.org/packages/12/98/25351cbe7740df7ecc95036903cbda125cf5bbcc35e2fc809713f2733fa0/secweb-1.25.2.tar.gz",
"platform": null,
"description": "<p align = \"center\"><img alt=\"Secweb logo\" src=\"https://raw.githubusercontent.com/tmotagam/Secweb/main/Secweb.jpg\"></p>\n<p align=\"center\"><em>Secweb helps in setting security headers for FastApi and Starlette</em></p>\n\n---\nSecweb is the pack of middlewares for setting security headers for fastapi and can also be used for any framework created on starlette it has 16 middlewares for setting headers of your website and also for your api(s).\n\n## **Features**\n\n- \ud83d\udd12 **Secure Headers**: Automatically apply headers like `Strict-Transport-Security`, `Content-Security-Policy`, and more.\n\n- \ud83d\udee0\ufe0f **Customizable Policies**: Flexibly build your own security policies.\n\n- \ud83d\ude80 **No External Dependencies**: Lightweight and easy to include in any project that uses **FastAPI** and **Starlette**.\n\n- \ud83e\udde9 **Easy to Use**: Integrate security headers in just a few lines of code.\n\n- \ud83d\udcda **Attribution to Trusted Sources**: Implements recommendations from MDN and OWASP.\n\n\n**The PermissionsPolicy middleware lies in development branch [here](https://github.com/tmotagam/Secweb/tree/Secweb-Beta#readme)**\n\nThe list of middleware is as follows:\n\n1. Content Security Policy (CSP)\n<br>\n\n2. Origin Agent Cluster\n<br>\n\n3. Referrer Policy\n<br>\n\n4. HTTP Strict Transport Security(HSTS)\n<br>\n\n5. HTTP Strict Transport Security(HSTS) for WebSockets\n<br>\n\n6. X-Content-Type-Options\n<br>\n\n7. X-DNS-Prefetch-Control\n<br>\n\n8. X-Download-Options\n<br>\n\n9. X-Frame\n<br>\n\n10. X-Permitted-Cross-Domain-Policies\n<br>\n\n11. X-XSS-Protection\n<br>\n\n12. Cross-Origin-Embedder-Policy\n<br>\n\n13. Cross-Origin-Opener-Policy\n<br>\n\n14. Cross-Origin-Resource-Policy\n<br>\n\n15. Clear-Site-Data\n<br>\n\n16. Cache-Control\n\n# Requirements\n\n* [Python >= 3.8](https://www.python.org/downloads/)\n* [Starlette](https://pypi.org/project/starlette/)\n\n# Installation\n\n```powershell\npip install Secweb\n```\n\n# Usage\n\nThe package Secweb can be used in two different ways:\n\n1. Use the SecWeb class - it includes all the 16 classes together\n<br>\n\n2. Use the 16 middleware classes separately\n\n## SecWeb class\n\n```Python\nfrom Secweb import SecWeb\n\nSecWeb(app=app) # The app is the ASGIapp required by the starlette to give access to the different methods to the class\n```\n\nThe above example uses all the default headers value that are preset. You can change the values by creating the option dict.\n\nYou can also set flags for nonce generation for csp header using the `script_nonce=True` and `style_nonce=True` flags. The `report_only` flag is added for csp report only header. For Clear-Site-Data header `Routes=[]` array is used for applying the header, it is empty by default.\n\n```Python\nfrom Secweb import SecWeb\n\nSecWeb(app=app, Option={'referrer': ['no-referrer']}, Routes=[], script_nonce=False, style_nonce=False, report_only=False)\n```\n\nThe `Option`-parameter uses 16 keys for calling middleware classes to set the user-defined policies or activating or deactivating headers.\n\n**Note: Activating/Deactivating the header can only be done in SecWeb class in Option param**\n\n```Python\nfrom Secweb import SecWeb\n\nSecweb(app=app, Option={'referrer': False, 'xframe': False})\n```\n\nThe values are as follows:\n\n1. `'csp'` for calling ContentSecurityPolicy class to set the user-defined values or activate/deactivate the header\n<br>\n\n2. `'referrer'` for calling ReferrerPolicy class to set the user-defined values or activate/deactivate the header\n<br>\n\n3. `'xdns'` for calling XDNSPrefetchControl class to set the user-defined values or activate/deactivate the header\n<br>\n\n4. `'xcdp'` for calling XPermittedCrossDomainPolicies class to set the user-defined values or activate/deactivate the header\n<br>\n\n5. `'hsts'` for calling HSTS class to set the user-defined values or activate/deactivate the header\n<br>\n\n6. `'wshsts'` for calling WsHSTS class to set the user-defined values for Websockets or activate/deactivate the header\n<br>\n\n7. `'xframe'` for calling XFrame class to set the user-defined values or activate/deactivate the header\n<br>\n\n8. `'coep'` for calling CrossOriginEmbedderPolicy class to set the user-defined values or activate/deactivate the header\n<br>\n\n9. `'coop'` for calling CrossOriginOpenerPolicy class to set the user-defined values or activate/deactivate the header\n<br>\n\n10. `'corp'` for calling CrossOriginResourcePolicy class to set the user-defined values or activate/deactivate the header\n<br>\n\n11. `'clearSiteData'` for calling ClearSiteData class to set the user-defined values or activate/deactivate the header\n<br>\n\n12. `'cacheControl'` for calling CacheControl class to set the user-defined values or activate/deactivate the header\n<br>\n\n13. `'xcto'` for activating/deactivating X-Content-Type-Options header\n<br>\n\n14. `'xdo'` for activating/deactivating X-Download-Options header\n<br>\n\n15. `'xss'` for activating/deactivating x-xss-protection header\n<br>\n\n16. `'oac'` for activating/deactivating Origin-Agent-Cluster header\n\n```python\n# Example of all values\n\nSecWeb(app=app, Option={'csp': {'default-src': [\"'self'\"]}, 'xframe':'SAMEORIGIN', 'hsts': {'max-age': 4, 'preload': True}, 'wshsts': {'max-age': 10, 'preload': True},'xcdp': 'all', 'xdns': 'on', 'referrer': ['no-referrer'], 'coep':'require-corp', 'coop':'same-origin-allow-popups', 'corp': 'same-site', 'clearSiteData': {'cache': True, 'storage': True}, 'cacheControl': {'public': True, 's-maxage': 600}, 'xss': False}, Routes=['/login/{id}', '/logout/{id:uuid}/username/{username:string}'])\n```\n\n## Middleware Classes\n\n### Content Security Policy (CSP)\n\n#### Nonce Processor\n\nThe Nonce_Processor module generates nonce for csp header\n\n```python\n# Some Code\n\nnonce = Nonce_Processor(DEFAULT_ENTROPY=90) # inject the nonce variable into the jinja or html\n\n# Some Code\n```\n\n`DEFAULT_ENTROPY` is used to set the nonce length.\n\nThe nonce processor needs to be called on the route the following example is of FastApi calling the nonce processor on the route\n\n```python\n\nfrom fastapi import FastAPI\nfrom Secweb.ContentSecurityPolicy import Nonce_Processor\n\napp = FastAPI()\n\n@app.get(\"/\")\n\nasync def root():\n\n# some code\n\nnonce = Nonce_Processor(DEFAULT_ENTROPY=90) # inject the nonce variable into the jinja or html\n\n# some more code\n```\nContentSecurityPolicy class sets the csp header.\n\n#### For FastApi server\n\n```python\nfrom fastapi import FastAPI\nfrom Secweb.ContentSecurityPolicy import ContentSecurityPolicy\n\napp = FastAPI() \n\napp.add_middleware(ContentSecurityPolicy, Option={'default-src': [\"'self'\"], 'base-uri': [\"'self'\"], 'block-all-mixed-content': []}, script_nonce=False, style_nonce=False, report_only=False)\n```\n\n#### For Starlette server\n\n```python\nfrom starlette.applications import Starlette\nfrom Secweb.ContentSecurityPolicy import ContentSecurityPolicy\n\n\napp = Starlette()\n\napp.add_middleware(ContentSecurityPolicy, Option={'default-src': [\"'self'\"], 'base-uri': [\"'self'\"], 'block-all-mixed-content': []}, script_nonce=False, style_nonce=False, report_only=False)\n```\n\n* `script_nonce=False`: nonce flag for inline Javascript\n* `style_nonce=False`: nonce flag for inline css\n* `report_only=False`: report only flag which makes csp report only header\n\nFor more detail on CSP header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy).\n\nFor more detail on CSP-report-only header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only).\n\n### Origin Agent Cluster\n\nOriginAgentCluster class sets the Origin-Agent-Cluster header. It takes no parameters.\n\n#### For FastApi server\n\n```python\nfrom fastapi import FastAPI\nfrom Secweb.OriginAgentCluster import OriginAgentCluster\n\napp = FastAPI()\napp.add_middleware(OriginAgentCluster)\n```\n \n#### For Starlette server\n\n```python\nfrom starlette.applications import Starlette\nfrom Secweb.OriginAgentCluster import OriginAgentCluster\n\napp = Starlette()\n\napp.add_middleware(OriginAgentCluster)\n```\n\nFor more detail on Origin-Agent-Cluster header go to [WHATWG Site](https://html.spec.whatwg.org/multipage/origin.html#origin-keyed-agent-clusters).\n\n### Referrer Policy\n\nReferrerPolicy class sets the Referrer-Policy header\n\n#### For FastApi server\n\n```python\nfrom fastapi import FastAPI\nfrom Secweb.ReferrerPolicy import ReferrerPolicy\n\napp = FastAPI()\n\napp.add_middleware(ReferrerPolicy, Option=['strict-origin-when-cross-origin'])\n```\n\n#### For Starlette server\n\n```python\nfrom starlette.applications import Starlette\nfrom Secweb.ReferrerPolicy import ReferrerPolicy\n\napp = Starlette()\napp.add_middleware(ReferrerPolicy, Option=['strict-origin-when-cross-origin'])\n```\n\nFor more detail on Referrer-Policy header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy).\n\n### HTTP Strict Transport Security (HSTS)\n\nHSTS class sets the Strict-Transport-Security header\n\n#### For FastApi server\n\n```python\nfrom fastapi import FastAPI\nfrom Secweb.StrictTransportSecurity import HSTS\n\napp = FastAPI()\n\napp.add_middleware(HSTS, Option={'max-age': 4, 'preload': True})\n```\n\n#### For Starlette server\n\n```python\nfrom starlette.applications import Starlette\nfrom Secweb.StrictTransportSecurity import HSTS\n\napp = Starlette()\n\napp.add_middleware(HSTS, Option={'max-age': 4, 'preload': True})\n```\n\nFor more detail on Strict-Transport-Security header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security).\n\n### HTTP Strict Transport Security (HSTS) for WebSockets\n\nHSTS class sets the Strict-Transport-Security header for Websockets\n\n#### For FastApi server\n\n```python\nfrom fastapi import FastAPI\nfrom Secweb.WsStrictTransportSecurity import WsHSTS\n\napp = FastAPI()\n\napp.add_middleware(WsHSTS, Option={'max-age': 4, 'preload': True})\n```\n \n#### For Starlette server\n\n```python\nfrom starlette.applications import Starlette\nfrom Secweb.WsStrictTransportSecurity import WsHSTS\n\napp = Starlette()\n\napp.add_middleware(WsHSTS, Option={'max-age': 4, 'preload': True})\n```\n\nFor more detail on Strict-Transport-Security header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security).\n\n### X-Content-Type-Options\n\nXContentTypeOptions class sets the X-Content-Type-Options header the class takes no parameters\n\n#### For FastApi server\n\n```python\nfrom fastapi import FastAPI\nfrom Secweb.XContentTypeOptions import XContentTypeOptions\n\napp = FastAPI()\n\napp.add_middleware(XContentTypeOptions)\n```\n \n#### For Starlette server\n\n```python\nfrom starlette.applications import Starlette\nfrom Secweb.XContentTypeOptions import XContentTypeOptions\n\napp = Starlette()\n\napp.add_middleware(XContentTypeOptions)\n```\n\nFor more detail on X-Content-Type-Options header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options).\n\n### X-DNS-Prefetch-Control\n\nXDNSPrefetchControl class sets the X-DNS-Prefetch-Control header\n\n#### For FastApi server\n\n```python\nfrom fastapi import FastAPI\nfrom Secweb.XDNSPrefetchControl import XDNSPrefetchControl\n\napp = FastAPI()\n\napp.add_middleware(XDNSPrefetchControl, Option='on')\n```\n\n#### For Starlette server\n\n```python\nfrom starlette.applications import Starlette\nfrom Secweb.XDNSPrefetchControl import XDNSPrefetchControl\n\napp = Starlette()\n\napp.add_middleware(XDNSPrefetchControl, Option='off')\n```\n\nFor more detail on X-DNS-Prefetch-Control header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control).\n\n### X-Download-Options\n\nXDownloadOptions class sets the X-Download-Options header the class takes no parameter\n\n#### For FastApi server\n\n```python\nfrom fastapi import FastAPI\nfrom Secweb.XDownloadOptions import XDownloadOptions\n\napp = FastAPI()\n\napp.add_middleware(XDownloadOptions)\n```\n\n#### For Starlette server\n \n```python\nfrom starlette.applications import Starlette\nfrom Secweb.XDownloadOptions import XDownloadOptions\n\napp = Starlette()\n\napp.add_middleware(XDownloadOptions)\n```\n\n### X-Frame\n\nXFrame class sets the X-Frame-Options header\n\n#### For FastApi server\n\n```python\nfrom fastapi import FastAPI\nfrom Secweb.XFrameOptions import XFrame\n\napp = FastAPI()\n\napp.add_middleware(XFrame, Option='DENY')\n```\n\n#### For Starlette server\n\n```python\nfrom starlette.applications import Starlette\nfrom Secweb.XFrameOptions import XFrame\n\napp = Starlette()\n\napp.add_middleware(XFrame, Option='DENY')\n```\n\nFor more detail on X-Frame-Options header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options).\n\n### X-Permitted-Cross-Domain-Policies\n\nXPermittedCrossDomainPolicies class sets the X-Permitted-Cross-Domain-Policies header\n\n#### For FastApi server\n\n```python\nfrom fastapi import FastAPI\nfrom Secweb.XPermittedCrossDomainPolicies import XPermittedCrossDomainPolicies\n\napp = FastAPI()\n\napp.add_middleware(XPermittedCrossDomainPolicies, Option='none')\n```\n\n#### For Starlette server\n\n```python\nfrom starlette.applications import Starlette\nfrom Secweb.XPermittedCrossDomainPolicies import XPermittedCrossDomainPolicies\n\napp = Starlette()\n\napp.add_middleware(XPermittedCrossDomainPolicies, Option='none')\n```\n\nFor more detail on X-Permitted-Cross-Domain-Policies header go to [OWASP Site](https://owasp.org/www-project-secure-headers/#x-permitted-cross-domain-policies).\n\n### X-XSS-Protection\n\nxXSSProtection class sets the X-XSS-Protection header the class takes no parameter\n\n#### For FastApi server\n\n```python\nfrom fastapi import FastAPI\nfrom Secweb.xXSSProtection import xXSSProtection\n\napp = FastAPI()\n\napp.add_middleware(xXSSProtection)\n```\n\n#### For Starlette server\n\n```python\nfrom starlette.applications import Starlette\nfrom Secweb.xXSSProtection import xXSSProtection\n\napp = Starlette()\n\napp.add_middleware(xXSSProtection)\n```\n\nFor more detail on X-XSS-Protection header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection).\n\n### Cross Origin Embedder Policy\n\nCrossOriginEmbedderPolicy class sets the Cross Origin Embedder Policy header\n\n#### For FastApi server\n\n```python\nfrom fastapi import FastAPI\nfrom Secweb.CrossOriginEmbedderPolicy import CrossOriginEmbedderPolicy\n\napp = FastAPI()\n\napp.add_middleware(CrossOriginEmbedderPolicy, Option='unsafe-none')\n```\n\n#### For Starlette server\n\n```python\nfrom starlette.applications import Starlette\nfrom Secweb.CrossOriginEmbedderPolicy import CrossOriginEmbedderPolicy\n\napp = Starlette()\n\napp.add_middleware(CrossOriginEmbedderPolicy, Option='unsafe-none')\n```\n\nFor more detail on Cross Origin Embedder Policy header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy).\n\n### Cross Origin Opener Policy\n\nCrossOriginOpenerPolicy class sets the Cross Origin Opener Policy header\n\n#### For FastApi server\n\n```python\nfrom fastapi import FastAPI\nfrom Secweb.CrossOriginOpenerPolicy import CrossOriginOpenerPolicy\n\napp = FastAPI()\n\napp.add_middleware(CrossOriginOpenerPolicy, Option='unsafe-none')\n```\n\n#### For Starlette server\n\n```python\nfrom starlette.applications import Starlette\nfrom Secweb.CrossOriginOpenerPolicy import CrossOriginOpenerPolicy\n\napp = Starlette()\n\napp.add_middleware(CrossOriginOpenerPolicy, Option='unsafe-none')\n```\n\nFor more detail on Cross Origin Opener Policy header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy).\n\n### Cross Origin Resource Policy\n\nCrossOriginResourcePolicy class sets the Cross Origin Resource Policy header\n\n#### For FastApi server\n\n```python\nfrom fastapi import FastAPI\nfrom Secweb.CrossOriginResourcePolicy import CrossOriginResourcePolicy\n\napp = FastAPI()\n\napp.add_middleware(CrossOriginResourcePolicy, Option='same-site')\n```\n\n#### For Starlette server\n\n```python\nfrom starlette.applications import Starlette\nfrom Secweb.CrossOriginResourcePolicy import CrossOriginResourcePolicy\n\napp = Starlette()\n\napp.add_middleware(CrossOriginResourcePolicy, Option='same-site')\n```\n\nFor more detail on Cross Origin Resource Policy header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy).\n\n### Clear Site Data\n\nClearSiteData class sets the Clear-Site-Data header. In this class the routes array is compulsory so that the header can only be applied to the specified route as it clears every data on the users browser you can add static, dynamic routes like shown below.\n\n#### For FastApi server\n\n```python\nfrom fastapi import FastAPI\nfrom Secweb.ClearSiteData import ClearSiteData\n\napp = FastAPI()\n\napp.add_middleware(ClearSiteData, Option={'cookies': True}, Routes=['/login', '/logout/{id}'])\n```\n\n#### For Starlette server\n\n```python\nfrom starlette.applications import Starlette\nfrom Secweb.ClearSiteData import ClearSiteData\n\napp = Starlette()\n\napp.add_middleware(ClearSiteData, Option={'cookies': True}, Routes=['/login', '/logout/{id}'])\n```\n\nFor more detail on Clear Site Data Header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data).\n\n### Cache Control\n\nCacheControl class sets the Cache-Control header. This is useful for controlling cached data on user`s browser\n\n#### For FastApi server\n\n```python\nfrom fastapi import FastAPI\nfrom Secweb.CacheControl import CacheControl\n\napp = FastAPI()\n\napp.add_middleware(CacheControl, Option={'s-maxage': 600, 'public': True})\n```\n\n#### For Starlette server\n\n```python\nfrom starlette.applications import Starlette\nfrom Secweb.CacheControl import CacheControl\n\napp = Starlette()\n\napp.add_middleware(CacheControl, Option={'s-maxage': 600, 'public': True})\n```\n\nFor more detail on Cache Control Header go to [MDN Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control).\n\n# Contributing\n\nPull requests and Issues are welcome. For major changes, please open an issue first to discuss what you would like to change.\n\n**[Github](https://github.com/tmotagam/Secweb)**\n\n# License\n\n**[MLP 2.0](https://www.mozilla.org/en-US/MPL/2.0/)**\n\n# Secweb Icon\n\n**[Secweb Icon](https://github.com/tmotagam/Secweb/blob/main/Secweb.jpg) \u00a9 2021 - 2025 by [Motagamwala Taha Arif Ali](https://github.com/tmotagam) is licensed under [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/?ref=chooser-v1)**\n",
"bugtrack_url": null,
"license": null,
"summary": "Secweb is a pack of security middlewares for fastApi and starlette servers it includes CSP, HSTS, and many more",
"version": "1.25.2",
"project_urls": {
"Documentation": "https://github.com/tmotagam/Secweb#readme",
"Homepage": "https://github.com/tmotagam/Secweb",
"Issues": "https://github.com/tmotagam/Secweb/issues",
"Repository": "https://github.com/tmotagam/Secweb.git"
},
"split_keywords": [
"fastapi security header",
" security header",
" starlette security header",
" secweb",
" fastapi csp",
" starlette csp",
" csp"
],
"urls": [
{
"comment_text": null,
"digests": {
"blake2b_256": "d32418bce9dfe5ebea6c85b5ebb9db68c3b9ea53905603946ec631720e130354",
"md5": "423191d5af94db103b29d6908a3de347",
"sha256": "73282af68d53e7f18d5ef9cd17b1d94cbb08271d8ab4fafba604978afa334114"
},
"downloads": -1,
"filename": "secweb-1.25.2-py3-none-any.whl",
"has_sig": false,
"md5_digest": "423191d5af94db103b29d6908a3de347",
"packagetype": "bdist_wheel",
"python_version": "py3",
"requires_python": ">=3.8",
"size": 40932,
"upload_time": "2025-07-14T06:27:02",
"upload_time_iso_8601": "2025-07-14T06:27:02.916285Z",
"url": "https://files.pythonhosted.org/packages/d3/24/18bce9dfe5ebea6c85b5ebb9db68c3b9ea53905603946ec631720e130354/secweb-1.25.2-py3-none-any.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": null,
"digests": {
"blake2b_256": "129825351cbe7740df7ecc95036903cbda125cf5bbcc35e2fc809713f2733fa0",
"md5": "639862572454a6bd277a1e89a9a6e66a",
"sha256": "d0b5325ecb5c1977aa296849530cf25f0517388ca12b98c4dcfe6cd65c22fbb0"
},
"downloads": -1,
"filename": "secweb-1.25.2.tar.gz",
"has_sig": false,
"md5_digest": "639862572454a6bd277a1e89a9a6e66a",
"packagetype": "sdist",
"python_version": "source",
"requires_python": ">=3.8",
"size": 25721,
"upload_time": "2025-07-14T06:27:04",
"upload_time_iso_8601": "2025-07-14T06:27:04.295401Z",
"url": "https://files.pythonhosted.org/packages/12/98/25351cbe7740df7ecc95036903cbda125cf5bbcc35e2fc809713f2733fa0/secweb-1.25.2.tar.gz",
"yanked": false,
"yanked_reason": null
}
],
"upload_time": "2025-07-14 06:27:04",
"github": true,
"gitlab": false,
"bitbucket": false,
"codeberg": false,
"github_user": "tmotagam",
"github_project": "Secweb#readme",
"travis_ci": false,
"coveralls": false,
"github_actions": true,
"lcname": "secweb"
}
JSON
