Masonite allows you to easily add security headers to your application. Masonite adds some sensible defaults but you can modify them as you need.
All you need to do is add the middleware to your HTTP_MIDDLEWARE constant in your config/middleware.py file:
This will add these default headers for your server:
If you want to change or add any headers, you just need to specify them in your config/middleware.py file and this middleware will automatically pick them up. For example you can change the X-Frame-Options header like this:
This will then change your headers to:
Notice the change in the new header we changed.
You may also choose to use CORS for your application for advanced security measures. Using CORS is very similar to the secure headers above. This is easily done through a service provider.
This provider needs to be at the TOP of the PROVIDERS array below your AppProvider so the request will not be rejected before it enters the lifecycle of the framework.
NOTE: The development server is currently NOT strong enough to work with CORS headers as most implementations fire 2 requests at the same time. If testing CORS locally, please use a stronger server like waitress or gunicorn
To get started just import the CorsProvider class into your config/providers.py file and add it to your PROVIDERS list:
Then inside your config/middleware.py file you can put your CORS headers as a dictionary. Here is a list of sensible defaults:
Now if you go to a browser you will see these headers being sent as a response from your server.