renjianbo
beff3fac8d
- Fix delete agent 500: clean up FK records (agent_llm_logs, permissions, schedules, executions, team_members) and unbind goals/tasks before delete - Remove hardcoded personality templates in Android, replace with dynamic system prompt generation from name + description - Set promptSectionsEnabled=false to bypass PromptComposer for personality - Add Tencent Cloud Linux deployment guide (Docker Compose) - Accumulated backend service updates, frontend UI fixes, Android app changes Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
46 lines
1.8 KiB
Python
46 lines
1.8 KiB
Python
"""安全响应头中间件 — HSTS / X-Frame-Options / X-Content-Type-Options 等。"""
|
||
from __future__ import annotations
|
||
|
||
from fastapi import Request, Response
|
||
from starlette.middleware.base import BaseHTTPMiddleware
|
||
from starlette.types import ASGIApp
|
||
|
||
from app.core.config import settings
|
||
|
||
|
||
class SecurityHeadersMiddleware(BaseHTTPMiddleware):
|
||
"""为 HTTP 响应注入安全加固头。
|
||
|
||
- Strict-Transport-Security (HSTS)：仅在 HTTPS 且启用时注入
|
||
- X-Content-Type-Options: nosniff
|
||
- X-Frame-Options: DENY
|
||
- X-XSS-Protection: 1; mode=block
|
||
- Referrer-Policy: strict-origin-when-cross-origin
|
||
- Permissions-Policy: 限制敏感 API（摄像头/麦克风/定位）
|
||
"""
|
||
|
||
def __init__(self, app: ASGIApp) -> None:
|
||
super().__init__(app)
|
||
|
||
async def dispatch(self, request: Request, call_next) -> Response:
|
||
response = await call_next(request)
|
||
|
||
# HSTS：仅在 HTTPS 且显式启用时注入（开发环境 http 不应发送 HSTS）
|
||
if settings.HSTS_ENABLED and request.url.scheme == "https":
|
||
hsts = f"max-age={settings.HSTS_MAX_AGE}"
|
||
if settings.HSTS_INCLUDE_SUBDOMAINS:
|
||
hsts += "; includeSubDomains"
|
||
response.headers["Strict-Transport-Security"] = hsts
|
||
|
||
# 通用安全头（对所有响应安全）
|
||
response.headers.setdefault("X-Content-Type-Options", "nosniff")
|
||
response.headers.setdefault("X-Frame-Options", "DENY")
|
||
response.headers.setdefault("X-XSS-Protection", "1; mode=block")
|
||
response.headers.setdefault("Referrer-Policy", "strict-origin-when-cross-origin")
|
||
response.headers.setdefault(
|
||
"Permissions-Policy",
|
||
"camera=(), microphone=(), geolocation=()",
|
||
)
|
||
|
||
return response
|