Internal
Public Access
Keith SmithandClaude Sonnet 5
f41939983a
README.md: backfill the Changelog with the 2026.9.5, 2026.8.31.1, 2026.8.31, and v1.2.0 releases that were missing (it jumped straight from 1.0.0 to 1.1.0). Also correct the stale "Mobile App Support"/"Mobile App Integration" sections - the native Android app is retired, and the sync protocol they describe now powers the offline PWA instead. Remove Firebug IT branding/contact info across README.md, API.md, and the site footer, and drop the stale tasks.firebugit.com fallback from development.py's ALLOWED_HOSTS/CSRF_TRUSTED_ORIGINS. AllowMobileAppFramingMiddleware detected the native app via a 'com.firebugit.keepitgoing' User-Agent check to allow WebView iframe embedding. With that app retired, replaced it with SecurityHeadersMiddleware, which applies the same X-Frame-Options/CSP headers unconditionally instead of only for non-mobile requests - same protection for real users, dead branch and dead branding gone. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
36 lines
1.2 KiB
Python
36 lines
1.2 KiB
Python
"""
|
|
Middleware that applies clickjacking protection headers to every response.
|
|
|
|
Previously also allowed iframe embedding for a native mobile app's WebView
|
|
(detected via User-Agent); that app has been retired in favor of the PWA,
|
|
so the headers are now applied unconditionally.
|
|
"""
|
|
|
|
|
|
class SecurityHeadersMiddleware:
|
|
"""Add X-Frame-Options and a CSP frame-ancestors policy to every response."""
|
|
|
|
def __init__(self, get_response):
|
|
self.get_response = get_response
|
|
|
|
def __call__(self, request):
|
|
response = self.get_response(request)
|
|
|
|
if 'X-Frame-Options' not in response:
|
|
response['X-Frame-Options'] = 'DENY'
|
|
|
|
if 'Content-Security-Policy' not in response:
|
|
response['Content-Security-Policy'] = (
|
|
"default-src 'self'; "
|
|
"script-src 'self' 'unsafe-inline'; "
|
|
"style-src 'self' 'unsafe-inline'; "
|
|
"img-src 'self' data: https:; "
|
|
"font-src 'self' data:; "
|
|
"connect-src 'self'; "
|
|
"frame-ancestors 'none'; "
|
|
"base-uri 'self'; "
|
|
"form-action 'self';"
|
|
)
|
|
|
|
return response
|