Skip to content

Security: nationalarchives/python-utilities

Security

docs/security.md

Security

Added in v1.3.0.

CspGenerator

A utility class to generate a CSP.

Examples

fromtna_utilities.securityimportCspGeneratorgenerator=CspGenerator()
# Add a single directive source (plus 'self')generator.script_src("example.com")
# Add multiple sources for a directive (plus 'self')generator.style_src("example.com", "another.net")
# Add a directive source without allowing 'self'generator.object_src("example.com", omit_self=True)
# Disallow a directivegenerator.disallow("worker-src")
generator.to_string()
# default-src 'self'; script-src 'self' example.com; style-src 'self' example.com another.net; object-src example.com; worker-src 'none';

common_security_headers

Renamed from security_headers in v1.4.0.

Get a dictionary of common security headers.

Arguments

ArgumentDescriptionDefault
cross_origin_embedder_policyThe option for the Cross-Origin-Embedder-Policy headerunsafe-none
cross_origin_opener_policyThe option for the Cross-Origin-Opener-Policy headersame-origin
cross_origin_resource_policyThe option for the Cross-Origin-Resource-Policy headersame-origin
x_content_type_optionsThe option for the X-Content-Type-Options headerno-sniff
x_permitted_cross_domain_policiesThe option for the X-Permitted-Cross-Domain-Policies headernone

Example

fromtna_utilities.securityimportsecurity_headersprint(security_headers())
# {# "Cross-Origin-Embedder-Policy": "unsafe-none",# "Cross-Origin-Opener-Policy": "same-origin",# "Cross-Origin-Resource-Policy": "same-origin",# "X-Permitted-Cross-Domain-Policies": "none",# "X-Content-Type-Options": "no-sniff",# }

There aren't any published security advisories