bacinet

Helmet-like http response Headers for FastAPI.

This is alpha software lacking testing and proper documentation. Use at your own risk!

Basic usage

Install package via pip install bacinet.

In your code, import apply from the package and add it as a middleware to your app:

from bacinet import apply
from fastapi import FastAPI, Request

app = FastAPI()


@app.middleware("http")
async def add_bacinet(request: Request, call_next):
    response = await call_next(request)
    apply(response.headers)
    return response

Alternatively, you can use an ASGI-conformant Middlware:

from bacinet import BacinetMiddleware


app = FastAPI()


app.add_middleware(BacinetMiddleware)

To change the default options, import and change the options dictionary from bacinet:

from bacinet import options

options["X-DNS-Prefetch-Control"] = "on"

You can also import individual header functions (like x_download_options) and apply those on your own applicator function that can be provided to BacinetMiddleware's constructor.

Headers

In it's standard form, the following headers will be set or removed by the middleware:

Default content-security policies

The following content-security policies are applied in the default setting:

• default-src 'self';base-uri 'self'
• font-src 'self' https: data:
• form-action 'self'
• frame-ancestors 'self'
• img-src 'self' data:
• object-src 'none'
• script-src 'self'
• script-src-attr 'none'
• style-src 'self' https: 'unsafe-inline'
• upgrade-insecure-requests