secure.py π is a lightweight package that adds optional security headers and cookie attributes for Python web frameworks.
aiohttp, Bottle, CherryPy, Django, Falcon, Flask, hug, Masonite, Pyramid, Quart, Responder, Sanic, Starlette, Tornado
pip:
$ pip install secure
Pipenv:
$ pipenv install secure
After installing secure:
from secure import SecureHeaders, SecureCookie
secure_headers = SecureHeaders()
secure_cookie = SecureCookie()
secure_headers.framework(response)
Default HTTP response headers:
Strict-Transport-Security: max-age=63072000; includeSubdomains
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer, strict-origin-when-cross-origin
Cache-control: no-cache, no-store, must-revalidate, max-age=0
Pragma: no-cache
Expires: 0
secure_cookie.framework(response, name="spam", value="eggs")
Default Set-Cookie HTTP response header:
Set-Cookie: spam=eggs; Path=/; secure; HttpOnly; SameSite=lax
Please see the full set of documentation at https://secure.readthedocs.io