apps/api/src/app/middleware/security_headers.py

from collections.abc import Callable

from starlette.middleware.base import BaseHTTPMiddleware
from starlette.requests import Request
from starlette.responses import Response

from app.config import settings


class SecurityHeadersMiddleware(BaseHTTPMiddleware):
    async def dispatch(self, request: Request, call_next: Callable) -> Response:
        response = await call_next(request)
        response.headers["X-Content-Type-Options"] = "nosniff"
        response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
        if settings.environment.lower() == "production":
            response.headers["X-Frame-Options"] = "SAMEORIGIN"
            response.headers["Permissions-Policy"] = "camera=(self), microphone=(self), geolocation=()"
            response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
        else:
            response.headers["Permissions-Policy"] = "camera=*, microphone=*, geolocation=()"
        return response