Missing security headers (ARCH2141)

Key python.security.missing-security-headers · Severity info · Category security · CWE CWE-693

Omitting key security headers like CSP, X-Content-Type-Options, and HSTS disables browser-side protections and opens the door to XSS and MIME-sniffing attacks.

Incorrect

@app.route("/")
def index():
    return render_template("index.html")

Correct

@app.after_request
def set_security_headers(resp):
    resp.headers["Content-Security-Policy"] = "default-src 'self'"
    resp.headers["X-Content-Type-Options"] = "nosniff"
    resp.headers["Strict-Transport-Security"] = "max-age=31536000"
    return resp

Fix

Add security headers such as CSP, X-Content-Type-Options, and HSTS to HTML responses in one central place.