secure.py 🔒 is a lightweight package that adds optional security headers and cookie attributes for Python web frameworks.
aiohttp, Bottle, CherryPy, Django, Falcon, Flask, hug, Masonite, Pyramid, Quart, Responder, Sanic, Starlette, Tornado
pip:
$ pip install securePipenv:
$ pipenv install secureAfter installing secure:
from secure import SecureHeaders, SecureCookie
secure_headers = SecureHeaders()
secure_cookie = SecureCookie()secure_headers.framework(response)
Default HTTP response headers:
Strict-Transport-Security: max-age=63072000; includeSubdomains
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer, strict-origin-when-cross-origin
Cache-control: no-cache, no-store, must-revalidate, max-age=0
Pragma: no-cache
Expires: 0secure_cookie.framework(response, name="spam", value="eggs")Default Set-Cookie HTTP response header:
Set-Cookie: spam=eggs; Path=/; secure; HttpOnly; SameSite=laxPlease see the full set of documentation at https://secure.readthedocs.io