47 lines
1.1 KiB
Python
47 lines
1.1 KiB
Python
|
import ipaddress
|
||
|
|
|
||
|
|
from fastapi.responses import JSONResponse
|
||
|
|
|
||
|
|
SECURITY_HEADERS = {
|
||
|
|
"Content-Security-Policy": (
|
||
|
|
"default-src 'self'; "
|
||
|
|
"script-src 'self' https://cdn.plot.ly; "
|
||
|
|
"style-src 'self' 'unsafe-inline'; "
|
||
|
|
"img-src 'self' data:; "
|
||
|
|
"connect-src 'self'; "
|
||
|
|
"font-src 'self' data:; "
|
||
|
|
"object-src 'none'; "
|
||
|
|
"base-uri 'self'; "
|
||
|
|
"frame-ancestors 'none'"
|
||
|
|
),
|
||
|
|
"Referrer-Policy": "no-referrer",
|
||
|
|
"X-Content-Type-Options": "nosniff",
|
||
|
|
"X-Frame-Options": "DENY",
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
def add_security_headers(response):
|
||
|
|
for key, value in SECURITY_HEADERS.items():
|
||
|
|
response.headers[key] = value
|
||
|
|
return response
|
||
|
|
|
||
|
|
|
||
|
|
def is_lan_or_loopback(host):
|
||
|
|
if not host:
|
||
|
|
return True
|
||
|
|
try:
|
||
|
|
ip_obj = ipaddress.ip_address(host)
|
||
|
|
except ValueError:
|
||
|
|
return True
|
||
|
|
return ip_obj.is_private or ip_obj.is_loopback
|
||
|
|
|
||
|
|
|
||
|
|
def lan_denied_response():
|
||
|
|
return add_security_headers(
|
||
|
|
JSONResponse(
|
||
|
|
status_code=403,
|
||
|
|
content={"detail": "Access Denied: Only LAN connections are allowed."},
|
||
|
|
)
|
||
|
|
)
|
||
|
|
|