Added HTTP Security Headers, for more security

backend/app/middleware/security_headers.py

@@ -0,0 +1,15 @@
+from fastapi import Request
+from starlette.middleware.base import BaseHTTPMiddleware
+
+class SecurityHeadersMiddleware(BaseHTTPMiddleware):
+    async def dispatch(self, request: Request, call_next):
+        response = await call_next(request)
+
+        response.headers["X-Content-Type-Options"] = "nosniff"
+        response.headers["X-Frame-Options"] = "DENY"
+        response.headers["X-Content-Security-Policy"] = "default-src 'self'"
+        response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
+
+        return response
+
+

backend/main.py

@@ -1,5 +1,4 @@
-from app.core.config import settings
-from fastapi import FastAPI, APIRouter
+from fastapi import FastAPI
 from contextlib import asynccontextmanager
 from slowapi import _rate_limit_exceeded_handler
 from slowapi.errors import RateLimitExceeded
@@ -14,8 +13,7 @@ from app.api.metric_routes import router as metrics_router
 from app.core.logging_middleware import APILoggingMiddleware
 from app.api.user_routes import router as user_router
 from app.core.limiter import limiter
-from starlette.middleware.sessions import SessionMiddleware
-from app.core.exceptions import add_global_exception_handlers
+from app.middleware.security_headers import SecurityHeadersMiddleware
 
 @asynccontextmanager
 async def lifespan(app: FastAPI):
@@ -27,24 +25,18 @@ app = FastAPI(
     lifespan=lifespan
 )
 
-add_global_exception_handlers(app)
-
 app.state.limiter = limiter
-
-api_v1_router = APIRouter(prefix="/api/v1")
-
-api_v1_router.include_router(profile_router)
-api_v1_router.include_router(user_router)
-api_v1_router.include_router(auth_router)
-api_v1_router.include_router(file_router)
-api_v1_router.include_router(feedback_router)
-api_v1_router.include_router(admin_router)
-api_v1_router.include_router(metrics_router)
-
-app.include_router(api_v1_router)
+app.include_router(profile_router)
+app.include_router(user_router)
+app.include_router(auth_router)
+app.include_router(file_router)
+app.include_router(feedback_router)
+app.include_router(admin_router)
+app.include_router(metrics_router)
 app.add_middleware(APILoggingMiddleware)
+app.include_router(profile_router)
 app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
-app.add_middleware(SessionMiddleware, secret_key=settings.SESSION_SECRET_KEY)
+app.add_middleware(SecurityHeadersMiddleware)
 
 @app.get("/")
 def home():