{"repo":"TypeError/secure","free":true,"listed":false,"github":"https://github.com/TypeError/secure","clone":"git clone https://github.com/TypeError/secure.git","description":"Modern Python library for HTTP security headers with safe defaults, configurable presets, and first-class ASGI/WSGI middleware (FastAPI, Django, Flask, Shiny, and more).","language":"Python","stars":1049,"topics":["fastapi","flask","django","content-security-policy","http-headers","python","security","security-headers","strict-transport-security","web-security"],"license":"MIT","category":"security-tools","readme_excerpt":"secure Define HTTP security headers once. Apply them consistently across Python web apps. secure provides a small, dependency-free API for configuring modern security headers across common Python web frameworks through ASGI middleware, WSGI middleware, or framework response hooks. Use it when you want to avoid copy-pasted header strings spread across handlers, hooks, and middleware. Quick links: Quick start · Headers · Middleware --- Why use secure Setting headers manually is fine for one endpoint. It gets harder to review when values are copied across routes, response hooks, reverse-proxy settings, and different framework integrations. secure helps you: - Keep one Secure policy object instead of scattered header strings - Apply the same policy through ASGI middleware, WSGI middleware, or response hooks - Start with practical presets, then customize headers for your application - Use builders for complex headers such as Content Security Policy and Permissions Policy - Make duplicate handling, header overwrites, and validation explicit The defaults are a reasonable starting point, not a substitute for application-specific review. Content Security Policy in particular should be adjusted for the scripts, styles, assets, and third-party services your app actually uses. --- Installation --- Quick start FastAPI / ASGI middleware Use middleware when you can attach secure once and cover the whole application. Response hooks and handlers Use the same policy object in framework hooks, ","default_branch":null,"files":null,"tree":[],"storefront":"/r/TypeError","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/TypeError/secure/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}