Spaces:
Running
Running
| """Cross-origin isolation headers for the served frontend. | |
| ``next.config.ts`` declares these headers, but ``headers()`` is a no-op under | |
| ``output: 'export'`` -- there is no Next server in the container to apply them, and | |
| ``next build`` says so explicitly. MediaPipe's threaded WASM backend needs cross-origin | |
| isolation, so the headers have to come from whatever actually serves the bundle, which | |
| is this application. | |
| Because the WASM and model files are self-hosted under the exported bundle rather than | |
| fetched from a CDN, ``require-corp`` is safe here: there is no cross-origin subresource | |
| left to be blocked. | |
| """ | |
| from __future__ import annotations | |
| from collections.abc import Awaitable, Callable | |
| from starlette.middleware.base import BaseHTTPMiddleware | |
| from starlette.requests import Request | |
| from starlette.responses import Response | |
| SECURITY_HEADERS = { | |
| # Required together to make the page cross-origin isolated, which is what | |
| # unlocks SharedArrayBuffer for MediaPipe's threaded backend. | |
| "Cross-Origin-Opener-Policy": "same-origin", | |
| "Cross-Origin-Embedder-Policy": "require-corp", | |
| "X-Content-Type-Options": "nosniff", | |
| "Referrer-Policy": "strict-origin-when-cross-origin", | |
| } | |
| class SecurityHeadersMiddleware(BaseHTTPMiddleware): | |
| """Apply the isolation and hardening headers to every response.""" | |
| async def dispatch( | |
| self, | |
| request: Request, | |
| call_next: Callable[[Request], Awaitable[Response]], | |
| ) -> Response: | |
| response = await call_next(request) | |
| for header, value in SECURITY_HEADERS.items(): | |
| response.headers.setdefault(header, value) | |
| # Same-origin subresources must opt in explicitly once COEP is on. | |
| response.headers.setdefault("Cross-Origin-Resource-Policy", "same-origin") | |
| return response | |