2.7 KiB
Every response your app sends should carry security headers, and a Python web security library like secure defines them once for Django, Flask, or FastAPI.
How to choose:
- FastAPI or Starlette: secure's ASGI middleware
- Django, Flask, and other frameworks: secure in a response hook or middleware
- Most apps: the default BALANCED preset
- Tighter CSP and stronger isolation: the STRICT preset
secure lets you keep one Secure policy object instead of scattered header strings, and applies it through ASGI middleware, WSGI middleware, or your framework's response hooks. Start with Secure.with_default_headers(), which matches Preset.BALANCED, the recommended default for most applications. Review the headers it generates, and move stricter only when needed: Preset.STRICT tightens the CSP and isolation.
The framework guide says to prefer middleware when your framework makes it easy and you want app-wide coverage. On FastAPI, add SecureASGIMiddleware with app.add_middleware(). On Flask, call set_headers(response) in an after_request hook. On Django, write a small Django middleware class that calls set_headers() and register it in MIDDLEWARE. For a framework the guide doesn't cover, configure one Secure instance and apply it to the response as late as possible before it's sent.
The defaults are a starting point, not a substitute for a review against your own app. Adjust the Content Security Policy in particular for the scripts, styles, assets, and third-party services your app actually uses. Build it with the ContentSecurityPolicy builder instead of a header string, and test a stricter policy against the real app before rollout.
Security headers help the browser enforce transport, embedding, and content-loading rules, but they don't replace output encoding, CSRF protection, authentication, or input validation. For web security materials beyond Python libraries, see awesome-web-security.