Skip to content

Commit 80c6bd8

Browse files
davegaeddertdavegaeddert
committed
SECURE_DEFAULT_HEADERS setting instead of several
1 parent 86e6dfa commit 80c6bd8

File tree

11 files changed

+15
-261
lines changed

11 files changed

+15
-261
lines changed

‎plain-auth/README.md

-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,6 @@ MIDDLEWARE = [
2828
"plain.middleware.common.CommonMiddleware",
2929
"plain.csrf.middleware.CsrfViewMiddleware",
3030
"plain.auth.middleware.AuthenticationMiddleware", # <--
31-
"plain.middleware.clickjacking.XFrameOptionsMiddleware",
3231
]
3332

3433
AUTH_USER_MODEL = "users.User"

‎plain-auth/plain/auth/README.md

-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@ MIDDLEWARE = [
2626
"plain.middleware.common.CommonMiddleware",
2727
"plain.csrf.middleware.CsrfViewMiddleware",
2828
"plain.auth.middleware.AuthenticationMiddleware", # <--
29-
"plain.middleware.clickjacking.XFrameOptionsMiddleware",
3029
]
3130

3231
AUTH_USER_MODEL = "users.User"

‎plain-importmap/test_project/settings.py

-1
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,6 @@
3030
"plain.middleware.common.CommonMiddleware",
3131
"plain.csrf.middleware.CsrfViewMiddleware",
3232
"plain.auth.middleware.AuthenticationMiddleware",
33-
"plain.middleware.clickjacking.XFrameOptionsMiddleware",
3433
]
3534

3635
ROOT_URLCONF = "app.urls"

‎plain-staff/README.md

-1
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,6 @@ MIDDLEWARE = [
5656
"plain.middleware.common.CommonMiddleware",
5757
"plain.csrf.middleware.CsrfViewMiddleware",
5858
"plain.auth.middleware.AuthenticationMiddleware",
59-
"plain.middleware.clickjacking.XFrameOptionsMiddleware",
6059
6160
"plain.staff.querystats.QueryStatsMiddleware",
6261
# Put additional middleware below querystats

‎plain-staff/plain/staff/README.md

-1
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,6 @@ MIDDLEWARE = [
5454
"plain.middleware.common.CommonMiddleware",
5555
"plain.csrf.middleware.CsrfViewMiddleware",
5656
"plain.auth.middleware.AuthenticationMiddleware",
57-
"plain.middleware.clickjacking.XFrameOptionsMiddleware",
5857
5958
"plain.staff.querystats.QueryStatsMiddleware",
6059
# Put additional middleware below querystats

‎plain-staff/plain/staff/querystats/README.md

-1
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@ MIDDLEWARE = [
3131
"plain.middleware.common.CommonMiddleware",
3232
"plain.csrf.middleware.CsrfViewMiddleware",
3333
"plain.auth.middleware.AuthenticationMiddleware",
34-
"plain.middleware.clickjacking.XFrameOptionsMiddleware",
3534

3635
"plain.staff.querystats.QueryStatsMiddleware",
3736
# Put additional middleware below querystats

‎plain/plain/middleware/clickjacking.py

-52
This file was deleted.

‎plain/plain/middleware/security.py

+4-37
Original file line numberDiff line numberDiff line change
@@ -7,15 +7,11 @@
77
class SecurityMiddleware:
88
def __init__(self, get_response):
99
self.get_response = get_response
10-
self.sts_seconds = settings.SECURE_HSTS_SECONDS
11-
self.sts_include_subdomains = settings.SECURE_HSTS_INCLUDE_SUBDOMAINS
12-
self.sts_preload = settings.SECURE_HSTS_PRELOAD
13-
self.content_type_nosniff = settings.SECURE_CONTENT_TYPE_NOSNIFF
1410
self.redirect = settings.SECURE_SSL_REDIRECT
1511
self.redirect_host = settings.SECURE_SSL_HOST
1612
self.redirect_exempt = [re.compile(r) for r in settings.SECURE_REDIRECT_EXEMPT]
17-
self.referrer_policy = settings.SECURE_REFERRER_POLICY
18-
self.cross_origin_opener_policy = settings.SECURE_CROSS_ORIGIN_OPENER_POLICY
13+
14+
self.default_headers = settings.SECURE_DEFAULT_HEADERS
1915

2016
def __call__(self, request):
2117
path = request.path.lstrip("/")
@@ -29,36 +25,7 @@ def __call__(self, request):
2925

3026
response = self.get_response(request)
3127

32-
if (
33-
self.sts_seconds
34-
and request.is_secure()
35-
and "Strict-Transport-Security" not in response
36-
):
37-
sts_header = "max-age=%s" % self.sts_seconds
38-
if self.sts_include_subdomains:
39-
sts_header += "; includeSubDomains"
40-
if self.sts_preload:
41-
sts_header += "; preload"
42-
response.headers["Strict-Transport-Security"] = sts_header
43-
44-
if self.content_type_nosniff:
45-
response.headers.setdefault("X-Content-Type-Options", "nosniff")
46-
47-
if self.referrer_policy:
48-
# Support a comma-separated string or iterable of values to allow
49-
# fallback.
50-
response.headers.setdefault(
51-
"Referrer-Policy",
52-
",".join(
53-
[v.strip() for v in self.referrer_policy.split(",")]
54-
if isinstance(self.referrer_policy, str)
55-
else self.referrer_policy
56-
),
57-
)
28+
for header, value in self.default_headers.items():
29+
response.headers.setdefault(header, value)
5830

59-
if self.cross_origin_opener_policy:
60-
response.setdefault(
61-
"Cross-Origin-Opener-Policy",
62-
self.cross_origin_opener_policy,
63-
)
6431
return response

‎plain/plain/preflight/security/base.py

+1-155
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,7 @@
11
from plain.exceptions import ImproperlyConfigured
22
from plain.runtime import settings
33

4-
from .. import Error, Warning, register
5-
6-
CROSS_ORIGIN_OPENER_POLICY_VALUES = {
7-
"same-origin",
8-
"same-origin-allow-popups",
9-
"unsafe-none",
10-
}
11-
REFERRER_POLICY_VALUES = {
12-
"no-referrer",
13-
"no-referrer-when-downgrade",
14-
"origin",
15-
"origin-when-cross-origin",
16-
"same-origin",
17-
"strict-origin",
18-
"strict-origin-when-cross-origin",
19-
"unsafe-url",
20-
}
4+
from .. import Warning, register
215

226
SECRET_KEY_INSECURE_PREFIX = "plain-insecure-"
237
SECRET_KEY_MIN_LENGTH = 50
@@ -41,43 +25,6 @@
4125
id="security.W001",
4226
)
4327

44-
W002 = Warning(
45-
"You do not have "
46-
"'plain.middleware.clickjacking.XFrameOptionsMiddleware' in your "
47-
"MIDDLEWARE, so your pages will not be served with an "
48-
"'x-frame-options' header. Unless there is a good reason for your "
49-
"site to be served in a frame, you should consider enabling this "
50-
"header to help prevent clickjacking attacks.",
51-
id="security.W002",
52-
)
53-
54-
W004 = Warning(
55-
"You have not set a value for the SECURE_HSTS_SECONDS setting. "
56-
"If your entire site is served only over SSL, you may want to consider "
57-
"setting a value and enabling HTTP Strict Transport Security. "
58-
"Be sure to read the documentation first; enabling HSTS carelessly "
59-
"can cause serious, irreversible problems.",
60-
id="security.W004",
61-
)
62-
63-
W005 = Warning(
64-
"You have not set the SECURE_HSTS_INCLUDE_SUBDOMAINS setting to True. "
65-
"Without this, your site is potentially vulnerable to attack "
66-
"via an insecure connection to a subdomain. Only set this to True if "
67-
"you are certain that all subdomains of your domain should be served "
68-
"exclusively via SSL.",
69-
id="security.W005",
70-
)
71-
72-
W006 = Warning(
73-
"Your SECURE_CONTENT_TYPE_NOSNIFF setting is not set to True, "
74-
"so your pages will not be served with an "
75-
"'X-Content-Type-Options: nosniff' header. "
76-
"You should consider enabling this header to prevent the "
77-
"browser from identifying content types incorrectly.",
78-
id="security.W006",
79-
)
80-
8128
W008 = Warning(
8229
"Your SECURE_SSL_REDIRECT setting is not set to True. "
8330
"Unless your site should be available over both SSL and non-SSL "
@@ -102,93 +49,19 @@
10249
id="security.W020",
10350
)
10451

105-
W021 = Warning(
106-
"You have not set the SECURE_HSTS_PRELOAD setting to True. Without this, "
107-
"your site cannot be submitted to the browser preload list.",
108-
id="security.W021",
109-
)
110-
111-
W022 = Warning(
112-
"You have not set the SECURE_REFERRER_POLICY setting. Without this, your "
113-
"site will not send a Referrer-Policy header. You should consider "
114-
"enabling this header to protect user privacy.",
115-
id="security.W022",
116-
)
117-
118-
E023 = Error(
119-
"You have set the SECURE_REFERRER_POLICY setting to an invalid value.",
120-
hint="Valid values are: {}.".format(", ".join(sorted(REFERRER_POLICY_VALUES))),
121-
id="security.E023",
122-
)
123-
124-
E024 = Error(
125-
"You have set the SECURE_CROSS_ORIGIN_OPENER_POLICY setting to an invalid "
126-
"value.",
127-
hint="Valid values are: {}.".format(
128-
", ".join(sorted(CROSS_ORIGIN_OPENER_POLICY_VALUES)),
129-
),
130-
id="security.E024",
131-
)
132-
13352
W025 = Warning(SECRET_KEY_WARNING_MSG, id="security.W025")
13453

13554

13655
def _security_middleware():
13756
return "plain.middleware.security.SecurityMiddleware" in settings.MIDDLEWARE
13857

13958

140-
def _xframe_middleware():
141-
return (
142-
"plain.middleware.clickjacking.XFrameOptionsMiddleware" in settings.MIDDLEWARE
143-
)
144-
145-
14659
@register(deploy=True)
14760
def check_security_middleware(package_configs, **kwargs):
14861
passed_check = _security_middleware()
14962
return [] if passed_check else [W001]
15063

15164

152-
@register(deploy=True)
153-
def check_xframe_options_middleware(package_configs, **kwargs):
154-
passed_check = _xframe_middleware()
155-
return [] if passed_check else [W002]
156-
157-
158-
@register(deploy=True)
159-
def check_sts(package_configs, **kwargs):
160-
passed_check = not _security_middleware() or settings.SECURE_HSTS_SECONDS
161-
return [] if passed_check else [W004]
162-
163-
164-
@register(deploy=True)
165-
def check_sts_include_subdomains(package_configs, **kwargs):
166-
passed_check = (
167-
not _security_middleware()
168-
or not settings.SECURE_HSTS_SECONDS
169-
or settings.SECURE_HSTS_INCLUDE_SUBDOMAINS is True
170-
)
171-
return [] if passed_check else [W005]
172-
173-
174-
@register(deploy=True)
175-
def check_sts_preload(package_configs, **kwargs):
176-
passed_check = (
177-
not _security_middleware()
178-
or not settings.SECURE_HSTS_SECONDS
179-
or settings.SECURE_HSTS_PRELOAD is True
180-
)
181-
return [] if passed_check else [W021]
182-
183-
184-
@register(deploy=True)
185-
def check_content_type_nosniff(package_configs, **kwargs):
186-
passed_check = (
187-
not _security_middleware() or settings.SECURE_CONTENT_TYPE_NOSNIFF is True
188-
)
189-
return [] if passed_check else [W006]
190-
191-
19265
@register(deploy=True)
19366
def check_ssl_redirect(package_configs, **kwargs):
19467
passed_check = not _security_middleware() or settings.SECURE_SSL_REDIRECT is True
@@ -239,30 +112,3 @@ def check_debug(package_configs, **kwargs):
239112
@register(deploy=True)
240113
def check_allowed_hosts(package_configs, **kwargs):
241114
return [] if settings.ALLOWED_HOSTS else [W020]
242-
243-
244-
@register(deploy=True)
245-
def check_referrer_policy(package_configs, **kwargs):
246-
if _security_middleware():
247-
if settings.SECURE_REFERRER_POLICY is None:
248-
return [W022]
249-
# Support a comma-separated string or iterable of values to allow fallback.
250-
if isinstance(settings.SECURE_REFERRER_POLICY, str):
251-
values = {v.strip() for v in settings.SECURE_REFERRER_POLICY.split(",")}
252-
else:
253-
values = set(settings.SECURE_REFERRER_POLICY)
254-
if not values <= REFERRER_POLICY_VALUES:
255-
return [E023]
256-
return []
257-
258-
259-
@register(deploy=True)
260-
def check_cross_origin_opener_policy(package_configs, **kwargs):
261-
if (
262-
_security_middleware()
263-
and settings.SECURE_CROSS_ORIGIN_OPENER_POLICY is not None
264-
and settings.SECURE_CROSS_ORIGIN_OPENER_POLICY
265-
not in CROSS_ORIGIN_OPENER_POLICY_VALUES
266-
):
267-
return [E024]
268-
return []

‎plain/plain/runtime/README.md

-1
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,6 @@ MIDDLEWARE = [
5959
"plain.middleware.common.CommonMiddleware",
6060
"plain.csrf.middleware.CsrfViewMiddleware",
6161
"plain.auth.middleware.AuthenticationMiddleware",
62-
"plain.middleware.clickjacking.XFrameOptionsMiddleware",
6362
]
6463

6564
if DEBUG:

0 commit comments

Comments
 (0)