Add security headers

canonical · Jan 6, 2021 · b982c9c · b982c9c
1 parent 699cc34
commit b982c9c
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 0 deletions.
diff --git a/canonicalwebteam/flask_base/app.py b/canonicalwebteam/flask_base/app.py
@@ -19,6 +19,12 @@
 )
 
 
+def set_security_headers(response):
+    response.headers["X-Frame-Options"] = "SAMEORIGIN"
+
+    return response
+
+
 def set_cache_control_headers(response):
     if flask.request.path.startswith("/_status"):
         response.cache_control.no_store = True
@@ -82,6 +88,7 @@ def __init__(
             )
         )
 
+        self.after_request(set_security_headers)
         self.after_request(set_cache_control_headers)
 
         self.context_processor(base_context)

diff --git a/tests/test_flask_base.py b/tests/test_flask_base.py
@@ -52,6 +52,14 @@ def test_wsgi_app(self):
         app = self.create_app()
         self.assertIsInstance(app.wsgi_app, ProxyFix)
 
+    def test_security_headers(self):
+        with create_test_app().test_client() as client:
+            response = client.get("page")
+            self.assertEqual(
+                response.headers.get("X-Frame-Options"),
+                "SAMEORIGIN",
+            )
+
     def test_default_cache_headers(self):
         with create_test_app().test_client() as client:
             cached_response = client.get("page")