secure-aiohttp 0.0.24

aiohttp additional security layer

secure-aiohttp

Library implements CSP and HSTS headers. In future CSRF token and maybe some other default security handlers will be added.

HSTS(Strict-Transport-Security)

Way for web site to tell browsers that it should only be accessed using HTTPS, instead of using HTTP. Which is usually used for connection, even if web site enables HTTPS. Helps to avoid man in the middle attack.(source) You can learn more here:

• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security

Avaliable parameters: | Parameter | Defenition | Default | |------------------------|-------------------------------------------------------------------|--------------------| | hsts | should HSTS header be added | True | | hsts_max_age | for how long in seconds browser should redirect directly to HTTPS | 31536000(one year) | | hsts_inclue_subdomains | should include subdomains | True | | hsts_preload | should use preload | True |

CSP(Content-Security-Policy)

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement to distribution of malware.(source) Basically it block all sources for front-end libraries/images/objects... that are not specified in whitelist to avoid downloading malicious code that can gather sensetive user data. You can learn more here:

• https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
• https://content-security-policy.com/

Avaliable parameters: | Parameter | Defenition | Default | |----------------|-------------------------------------------------------------------|-------------------------------| | csp | Should CSP header be added and if yes - what it should include | None | | csp_testing | Enable CSP in report only mode, without actually blocking sources | False | | scp_report_uri | Where browser should send CSP reports | /secureaiohttp-csp-report-uri |

csp parameter can be either:

• None to avoid using CSP header at all
• default|same-origin|google-analitycs to use predifined CSP header
• dict with custom CSP parameters, example:

'myCSP': {
    'connect-src': 'self',
    'default-src': 'none',
    'img-src': 'self',
    'script-src': 'self',
    'style-src': 'self',
    'report-uri': '/my-csp-report-handler',
    'block-all-mixed-content': None
}

You need to pass None for parameters that require no values, like block-all-mixed-content.

Predifined CPS header variants are taken from https://content-security-policy.com/ and include:

• default: This policy allows images, scripts, AJAX, and CSS from the same origin, and does not allow any other resources to load (eg object, frame, media, etc). It is a good starting point for many sites.
• google-analitycs: Allow Google Analytics, Google AJAX CDN and Same Origin.
• same-origin: Only Allow Scripts from the same origin.

Examples

You can see some simple examples in example folder.

Contribution

Any contributions are welcome! Take action in securing your users! ;)

License

secure-aiohttp is offered under the Apache 2 license.