



secure.py 0.3.0 documentation

secure.py[¶](#secure-py "Permalink to this headline")

=====================================================

[![version](https://img.shields.io/pypi/v/secure.svg)](https://pypi.org/project/secure/) [![Python 3](https://img.shields.io/badge/python-3-blue.svg)](https://www.python.org/downloads/) [![license](https://img.shields.io/pypi/l/secure.svg)](https://pypi.org/project/secure/) [![black](https://img.shields.io/badge/code%20style-black-000000.svg)](https://github.com/ambv/black)

secure.py 🔒 is a lightweight package that adds optional security headers for Python web frameworks.

Supported Python web frameworks:[¶](#supported-python-web-frameworks "Permalink to this headline")

--------------------------------------------------------------------------------------------------

[aiohttp](https://docs.aiohttp.org),

[Bottle](https://bottlepy.org), [CherryPy](https://cherrypy.org),

[Django](https://www.djangoproject.com),

[Falcon](https://falconframework.org),

[FastAPI](https://fastapi.tiangolo.com),

[Flask](http://flask.pocoo.org),

[hug](http://www.hug.rest),

[Masonite](https://docs.masoniteproject.com),

[Pyramid](https://trypyramid.com),

[Quart](https://pgjones.gitlab.io/quart/),

[Responder](https://python-responder.org),

[Sanic](https://sanicframework.org),

[Starlette](https://www.starlette.io/),

[Tornado](https://www.tornadoweb.org/)

Install[¶](#install "Permalink to this headline")

-------------------------------------------------

**pip**:

```

$ pip install secure

```

**Pipenv**:

```

$ pipenv install secure

```

After installing secure.py:

```

import secure

secure\_headers = secure.Secure()

```

Documentation[¶](#documentation "Permalink to this headline")

-------------------------------------------------------------

### Secure Headers[¶](#secure-headers "Permalink to this headline")

Security Headers are HTTP response headers that, when set, can enhance

the security of your web application by enabling browser security

policies.

You can assess the security of your HTTP response headers at

[securityheaders.com](https://securityheaders.com)

*Recommendations used by secure,py and more information regarding

security headers can be found at the* [OWASP Secure Headers

Project](https://www.owasp.org/index.php/OWASP_Secure_Headers_Project) *.*

#### Server[¶](#server "Permalink to this headline")

Contain information about server software

**Default Value:** `NULL` *(obfuscate server information, not

included by default)*

#### Strict-Transport-Security (HSTS)[¶](#strict-transport-security-hsts "Permalink to this headline")

Ensure application communication is sent over HTTPS

**Default Value:** `max-age=63072000; includeSubdomains`

#### X-Frame-Options (XFO)[¶](#x-frame-options-xfo "Permalink to this headline")

Disable framing from different origins (clickjacking defense)

**Default Value:** `SAMEORIGIN`

#### X-XSS-Protection[¶](#x-xss-protection "Permalink to this headline")

Enable browser cross-site scripting filters

**Default Value:** `0`

#### X-Content-Type-Options[¶](#x-content-type-options "Permalink to this headline")

Prevent MIME-sniffing

**Default Value:** `nosniff`

#### Content-Security-Policy (CSP)[¶](#content-security-policy-csp "Permalink to this headline")

Prevent cross-site injections

**Default Value:** `script-src 'self'; object-src 'self'` *(not

included by default)*\*

#### Referrer-Policy[¶](#referrer-policy "Permalink to this headline")

Enable full referrer if same origin, remove path for cross origin and

disable referrer in unsupported browsers

**Default Value:** `no-referrer`

#### Cache-control[¶](#cache-control "Permalink to this headline")

Prevent cacheable HTTPS response

**Default Value:** `no-cache`

#### Permissions-Policy[¶](#permissions-policy "Permalink to this headline")

Disable browser features and APIs

**Default Value:** accelerometer=(), ambient-light-sensor=(), autoplay=(),camera=(), encrypted-media=(), fullscreen=(),geolocation=(), gyroscope=(), magnetometer=(),microphone=(); midi=(), payment=(), picture-in-picture=(), speaker=(), sync-xhr=(), usb=(), vr=()” *(not included by default)*

**Additional information:**

* The `Strict-Transport-Security` (HSTS) header will tell the browser to **only** utilize secure HTTPS connections for the domain, and in the default configuration, including all subdomains. The HSTS header requires trusted certificates and users will unable to connect to the site if using self-signed or expired certificates. The browser will honor the HSTS header for the time directed in the `max-age` attribute *(default = 2 years)*, and setting the `max-age` to `0` will disable an already set HSTS header. Use the `hsts=False` option to not include the HSTS header in Secure Headers.

* The `Content-Security-Policy` (CSP) header can break functionality and can (and should) be carefully constructed, use the `csp=True` option to enable default values.

#### Usage[¶](#usage "Permalink to this headline")

`secure\_headers.framework(response)`

**Default HTTP response headers:**

```

Strict-Transport-Security: max-age=63072000; includeSubdomains

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 0

X-Content-Type-Options: nosniff

Referrer-Policy: no-referrer, strict-origin-when-cross-origin

Cache-control: no-cache, no-store, must-revalidate, max-age=0

Pragma: no-cache

Expires: 0

```

#### Options[¶](#options "Permalink to this headline")

You can toggle the setting of headers with default values by passing

`True` or `False` and override default values by passing a string to

the following options:

* `server` - set the Server header, e.g. `Server=“Secure”`

*(string / bool / SecurePolicies, default=False)*

* `hsts` - set the Strict-Transport-Security header *(string / bool /

SecurePolicies, default=True)*

* `xfo` - set the X-Frame-Options header *(string / bool /

SecurePolicies, default=True)*

* `xxp` - set the X-XSS-Protection header *(string / bool /

SecurePolicies, default=True)*

* `content` - set the X-Content-Type-Options header *(string / bool /

SecurePolicies, default=True)*

* `csp` - set the Content-Security-Policy *(string / bool /

SecurePolicies, default=False)* \*

* `referrer` - set the Referrer-Policy header *(string / bool /

SecurePolicies, default=True)*

* `cache` - set the Cache-control and Pragma headers *(string / bool

/ SecurePolicies, default=True)*

* `feature` - set the Feature-Policy header *(SecurePolicies / string

/ bool / SecurePolicies, default=False)*

**Example:**

```

from secure import SecureHeaders

secure\_headers = SecureHeaders(csp=True, hsts=False, xfo="DENY")

. . .

secure\_headers.framework(response)

```

### Policy Builder[¶](#policy-builder "Permalink to this headline")

#### ContentSecurityPolicy()[¶](#contentsecuritypolicy "Permalink to this headline")

**Directives:** `base\_uri(sources)`,

`child\_src(sources)`, `connect\_src(sources)`,

`default\_src(sources)`, `font\_src(sources)`,

`form\_action(sources)`, `frame\_ancestors(sources)`,

`frame\_src(sources)`, `img\_src(sources)`,

`manifest\_src(sources)`, `media\_src(sources)`,

`object\_src(sources)`, `plugin\_types(types)`,

`report\_to(json\_object)`, `report\_uri(uri)`,

`require\_sri\_for(values)`, `sandbox(values)`,

`script\_src(sources)`, `style\_src(sources)`,

`upgrade\_insecure\_requests()`, `worker\_src(sources)`

**Example:**

```

csp\_policy = (

secure.ContentSecurityPolicy()

.default\_src("'none'")

.base\_uri("'self'")

.connect\_src("'self'", "api.spam.com")

.frame\_src("'none'")

.img\_src("'self'", "static.spam.com")

)

secure\_headers = secure.Secure(csp=csp\_policy)

# default-src 'none'; base-uri 'self'; connect-src 'self' api.spam.com; frame-src 'none'; img-src 'self' static.spam.com

```

*You can check the effectiveness of your CSP Policy at the* [CSP

Evaluator](https://csp-evaluator.withgoogle.com)

#### StrictTransportSecurity()[¶](#stricttransportsecurity "Permalink to this headline")

**Directives:** `include\_subDomains()`, `max\_age(seconds)`,

`preload()`

**Example:**

```

hsts\_value = (

secure.StrictTransportSecurity()

.include\_subdomains()

.preload()

.max\_age(2592000)

)

secure\_headers = secure.Secure(hsts=hsts\_value)

# includeSubDomains; preload; max-age=2592000

```

#### XFrameOptions()[¶](#xframeoptions "Permalink to this headline")

**Directives:** `allow\_from(uri)`, `deny()`, `sameorigin()`

**Example:**

```

xfo\_value = secure.XFrameOptions().deny()

secure\_headers = secure.Secure(xfo=xfo\_value)

# deny

```

#### ReferrerPolicy()[¶](#referrerpolicy "Permalink to this headline")

**Directives:** `no\_referrer()`, `no\_referrer\_when\_downgrade()`,

`origin()`, `origin\_when\_cross\_origin()`, `same\_origin()`,

`strict\_origin()`, `strict\_origin\_when\_cross\_origin()`,

`unsafe\_url()`

**Example:**

```

referrer = secure.ReferrerPolicy().strict\_origin()

secure\_headers = secure.Secure(referrer=referrer).headers()

# strict-origin

```

#### PermissionsPolicy()[¶](#permissionspolicy "Permalink to this headline")

**Directives:** `accelerometer(allowlist)`,

`ambient\_light\_sensor(allowlist)`, `autoplay(allowlist)`,

`camera(allowlist)`, `document\_domain(allowlist)`,

`encrypted\_media(allowlist)`, `fullscreen(allowlist)`,

`geolocation(allowlist)`, `gyroscope(allowlist)`,

`magnetometer(allowlist)`, `microphone(allowlist)`,

`midi(allowlist)`, `payment(allowlist)`,

`picture\_in\_picture(allowlist)`, `speaker(allowlist)`,

`sync\_xhr(allowlist)`, `usb(allowlist)`, `Values(allowlist)`,

`vr(allowlist)`

**Example:**

```

permissions = (

secure.PermissionsPolicy().geolocation("self", '"spam.com"').vibrate()

)

secure\_headers = secure.Secure(permissions=permissions).headers()

# geolocation=(self "spam.com"), vibrate=()

```

#### CacheControl()[¶](#cachecontrol "Permalink to this headline")

**Directives:** `immutable()`, `max\_age(seconds)`,

`max\_stale(seconds)`, `min\_fresh(seconds)`, `must\_revalidate()`,

`no\_cache()`, `no\_store()`, `no\_transform()`,

`only\_if\_cached()`, `private()`, `proxy\_revalidate()`,

`public()`, `s\_maxage(seconds)`, `stale\_if\_error(seconds)`,

`stale\_while\_revalidate(seconds)`,

**Example:**

```

cache = secure.CacheControl().no\_cache()

secure\_headers = secure.Secure(cache=cache).headers()

# no-store

```

#### Usage[¶](#usage "Permalink to this headline")

**Example:**

```

import uvicorn

from fastapi import FastAPI

import secure

app = FastAPI()

server = secure.Server().set("Secure")

csp = (

    secure.ContentSecurityPolicy()

    .default\_src("'none'")

    .base\_uri("'self'")

    .connect\_src("'self'" "api.spam.com")

    .frame\_src("'none'")

    .img\_src("'self'", "static.spam.com")

)

hsts = secure.StrictTransportSecurity().include\_subdomains().preload().max\_age(2592000)

referrer = secure.ReferrerPolicy().no\_referrer()

permissions\_value = (

    secure.PermissionsPolicy().geolocation("self", "'spam.com'").vibrate()

)

cache\_value = secure.CacheControl().must\_revalidate()

secure\_headers = secure.Secure(

    server=server,

    csp=csp,

    hsts=hsts,

    referrer=referrer,

    permissions=permissions\_value,

    cache=cache\_value,

)

@app.middleware("http")

async def set\_secure\_headers(request, call\_next):

    response = await call\_next(request)

    secure\_headers.framework.fastapi(response)

    return response

@app.get("/")

async def root():

    return {"message": "Secure"}

if \_\_name\_\_ == "\_\_main\_\_":

    uvicorn.run(app, port=8081, host="localhost")

. . .

```

Response Headers:

```

server: Secure

strict-transport-security: includeSubDomains; preload; max-age=2592000

x-frame-options: SAMEORIGIN

x-xss-protection: 0

x-content-type-options: nosniff

content-security-policy: default-src 'none'; base-uri 'self'; connect-src 'self'api.spam.com; frame-src 'none'; img-src 'self' static.spam.com

referrer-policy: no-referrer

cache-control: must-revalidate

permissions-policy: geolocation=(self 'spam.com'), vibrate=()

```

### Supported Frameworks[¶](#supported-frameworks "Permalink to this headline")

#### Framework Agnostic[¶](#framework-agnostic "Permalink to this headline")

Return Dictionary of Headers:

`secure\_headers.headers()`

**Example:**

```

secure\_headers.framework.headers(csp=True, feature=True)

```

**Return Value:**

`{'Strict-Transport-Security': 'max-age=63072000; includeSubdomains', 'X-Frame-Options': 'SAMEORIGIN', 'X-XSS-Protection': '0', 'X-Content-Type-Options': 'nosniff', 'Content-Security-Policy': "script-src 'self'; object-src 'self'", 'Referrer-Policy': 'no-referrer, strict-origin-when-cross-origin', 'Cache-control': 'no-cache, no-store, must-revalidate', 'Pragma': 'no-cache', 'Feature-Policy': "accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; camera 'none'; encrypted-media 'none';fullscreen 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; midi 'none';payment 'none'; picture-in-picture 'none'; speaker 'none'; sync-xhr 'none'; usb 'none'; vr 'none';"}`

#### aiohttp[¶](#aiohttp "Permalink to this headline")

`secure\_headers.framework.aiohttp(resp)`

**Example:**

```

from aiohttp import web

from aiohttp.web import middleware

import secure

secure\_headers = secure.Secure()

. . .

@middleware

async def set\_secure\_headers(request, handler):

    resp = await handler(request)

    secure\_headers.framework.aiohttp(resp)

    return resp

. . .

app = web.Application(middlewares=[set\_secure\_headers])

. . .

```

#### Bottle[¶](#bottle "Permalink to this headline")

`secure\_headers.framework.bottle(response)`

**Example:**

```

from bottle import route, run, response, hook

import secure

secure\_headers = secure.Secure()

. . .

@hook("after\_request")

def set\_secure\_headers():

    secure\_headers.framework.bottle(response)

. . .

```

#### CherryPy[¶](#cherrypy "Permalink to this headline")

`"tools.response\_headers.headers": secure\_headers.framework.cherrypy()`

**Example:**

CherryPy [Application

Configuration](http://docs.cherrypy.org/en/latest/config.html#application-config):

```

import cherrypy

import secure

secure\_headers = secure.Secure()

. . .

config = {

    "/": {

        "tools.response\_headers.on": True,

        "tools.response\_headers.headers": secure\_headers.framework.cherrypy(),

    }

}

. . .

```

#### Django[¶](#django "Permalink to this headline")

`secure\_headers.framework.django(response)`

**Example:**

Django [Middleware

Documentation](https://docs.djangoproject.com/en/2.1/topics/http/middleware/):

```

# securemiddleware.py

import secure

secure\_headers = secure.Secure()

. . .

def set\_secure\_headers(get\_response):

    def middleware(request):

        response = get\_response(request)

        secure\_headers.framework.django(response)

        return response

    return middleware

. . .

```

```

# settings.py

...

MIDDLEWARE = [

    'app.securemiddleware.set\_secure\_headers'

]

...

```

#### FastAPI[¶](#fastapi "Permalink to this headline")

`secure\_headers.framework.falcon(resp)`

**Example:**

```

from fastapi import FastAPI

import secure

secure\_headers = secure.Secure()

. . .

@app.middleware("http")

async def set\_secure\_headers(request, call\_next):

    response = await call\_next(request)

    secure\_headers.framework.fastapi(response)

    return response

. . .

```

#### Falcon[¶](#falcon "Permalink to this headline")

`secure\_headers.framework.falcon(resp)`

**Example:**

```

import falcon

import secure

secure\_headers = secure.Secure()

. . .

class SetSecureHeaders(object):

    def process\_request(self, req, resp):

        secure\_headers.framework.falcon(resp)

. . .

app = api = falcon.API(middleware=[SetSecureHeaders()])

. . .

```

#### Flask[¶](#flask "Permalink to this headline")

`secure\_headers.framework.flask(response)`

**Example:**

```

from flask import Flask, Response

import secure

secure\_headers = secure.Secure()

app = Flask(\_\_name\_\_)

. . .

@app.after\_request

def set\_secure\_headers(response):

    secure\_headers.framework.flask(response)

    return response

. . .

```

#### hug[¶](#hug "Permalink to this headline")

`secure\_headers.framework.hug(response)`

**Example:**

```

import hug

import secure

secure\_headers = secure.Secure()

 . . .

@hug.response\_middleware()

def set\_secure\_headers(request, response, resource):

    secure\_headers.framework.hug(response)

 . . .

```

#### Masonite[¶](#masonite "Permalink to this headline")

`secure\_headers.framework.masonite(self.request)`

**Example:**

Masonite

[Middleware](https://docs.masoniteproject.com/advanced/middleware#creating-middleware):

```

# SecureMiddleware.py

from masonite.request import Request

import secure

secure\_headers = secure.Secure()

class SecureMiddleware:

    def \_\_init\_\_(self, request: Request):

        self.request = request

    def before(self):

        secure\_headers.framework.masonite(self.request)

 . . .

```

```

 # middleware.py

 ...

HTTP\_MIDDLEWARE = [

    SecureMiddleware,

]

 ...

```

#### Pyramid[¶](#pyramid "Permalink to this headline")

Pyramid

[Tween](https://docs.pylonsproject.org/projects/pyramid/en/latest/narr/hooks.html#registering-tweens):

```

def set\_secure\_headers(handler, registry):

    def tween(request):

        response = handler(request)

        secure\_headers.framework.pyramid(response)

        return response

    return tween

```

**Example:**

```

from pyramid.config import Configurator

from pyramid.response import Response

import secure

secure\_headers = secure.Secure()

. . .

def set\_secure\_headers(handler, registry):

    def tween(request):

        response = handler(request)

        secure\_headers.framework.pyramid(response)

        return response

    return tween

. . .

config.add\_tween(".set\_secure\_headers")

. . .

```

#### Quart[¶](#quart "Permalink to this headline")

`secure\_headers.framework.quart(response)`

**Example:**

```

from quart import Quart, Response

import secure

secure\_headers = secure.Secure()

app = Quart(\_\_name\_\_)

. . .

@app.after\_request

async def set\_secure\_headers(response):

    secure\_headers.framework.quart(response)

    return response

. . .

```

#### Responder[¶](#responder "Permalink to this headline")

`secure\_headers.framework.responder(resp)`

**Example:**

```

import responder

import secure

secure\_headers = secure.Secure()

api = responder.API()

. . .

@api.route(before\_request=True)

def set\_secure\_headers(req, resp):

    secure\_headers.framework.responder(resp)

. . .

```

You should use Responder’s [built in

HSTS](https://python-responder.org/en/latest/tour.html#hsts-redirect-to-https)

and pass the `hsts=False` option.

#### Sanic[¶](#sanic "Permalink to this headline")

`secure\_headers.framework.sanic(response)`

**Example:**

```

from sanic import Sanic

import secure

secure\_headers = secure.Secure()

app = Sanic()

. . .

@app.middleware("response")

async def set\_secure\_headers(request, response):

    secure\_headers.framework.sanic(response)

. . .

```

*To set Cross Origin Resource Sharing (CORS) headers, please

see* [sanic-cors](https://github.com/ashleysommer/sanic-cors) *.*

#### Starlette[¶](#starlette "Permalink to this headline")

`secure\_headers.framework.starlette(response)`

**Example:**

```

from starlette.applications import Starlette

import uvicorn

import secure

secure\_headers = secure.Secure()

app = Starlette()

. . .

@app.middleware("http")

async def set\_secure\_headers(request, call\_next):

    response = await call\_next(request)

    secure\_headers.framework.starlette(response)

    return response

. . .

```

#### Tornado[¶](#tornado "Permalink to this headline")

`secure\_headers.framework.tornado(self)`

**Example:**

```

import tornado.ioloop

import tornado.web

import secure

secure\_headers = secure.Secure()

. . .

class BaseHandler(tornado.web.RequestHandler):

    def set\_default\_headers(self):

        secure\_headers.framework.tornado(self)

. . .

```

### Resources[¶](#resources "Permalink to this headline")

#### Frameworks[¶](#frameworks "Permalink to this headline")

* [aiohttp](https://github.com/aio-libs/aiohttp) - Asynchronous HTTP

client/server framework for asyncio and Python

* [Bottle](https://github.com/bottlepy/bottle) - A fast and simple

micro-framework for python web-applications.

* [CherryPy](https://github.com/cherrypy/cherrypy) - A pythonic,

object-oriented HTTP framework.

* [Django](https://github.com/django/django/) - The Web framework

for perfectionists with deadlines.

* [Falcon](https://github.com/falconry/falcon) - A bare-metal Python

web API framework for building high-performance microservices, app

backends, and higher-level frameworks.

* [Flask](https://github.com/pallets/flask) - The Python micro

framework for building web applications.

* [hug](https://github.com/timothycrosley/hug) - Embrace the APIs of

the future. Hug aims to make developing APIs as simple as possible,

but no simpler.

* [Masonite](https://github.com/MasoniteFramework/masonite) - The Modern And Developer Centric Python Web Framework.

* [Pyramid](https://github.com/Pylons/pyramid) - A Python web framework

* [Quart](https://gitlab.com/pgjones/quart) - A Python ASGI web

microframework.

* [Responder](https://github.com/kennethreitz/responder) - A

familiar HTTP Service Framework

* [Sanic](https://github.com/huge-success/sanic) - An Async Python

3.5+ web server that’s written to go fast

* [Starlette](https://github.com/encode/starlette) - The little ASGI

framework that shines. ✨

* [Tornado](https://github.com/tornadoweb/tornado) - A Python web

framework and asynchronous networking library, originally developed

at FriendFeed.

#### General[¶](#general "Permalink to this headline")

* [OWASP - Secure Headers

Project](https://www.owasp.org/index.php/OWASP_Secure_Headers_Project)

* [OWASP - Session Management Cheat

Sheet](https://www.owasp.org/index.php/Session_Management_Cheat_Sheet#Cookies)

* [Mozilla Web

Security](https://infosec.mozilla.org/guidelines/web_security)

* [securityheaders.com](https://securityheaders.com)

#### Policies[¶](#policies "Permalink to this headline")

* **CSP:** [CSP Cheat Sheet | Scott

Helme](https://scotthelme.co.uk/csp-cheat-sheet/),

[Content-Security-Policy |

MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy),

[Content Security Policy Cheat Sheet |

OWASP](https://www.owasp.org/index.php/Content_Security_Policy_Cheat_Sheet),

[Content Security Policy CSP Reference &

Examples](https://content-security-policy.com)

* **XXP:** [X-XSS-Protection |

MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection)

* **XFO:** [X-Frame-Options |

MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options)

* **HSTS:** [Strict-Transport-Security |

MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security),

[HTTP Strict Transport Security Cheat Sheet |

OWASP](https://www.owasp.org/index.php/HTTP_Strict_Transport_Security_Cheat_Sheet)

* **Referrer:** [A new security header: Referrer Policy | Scott

Helme](https://scotthelme.co.uk/a-new-security-header-referrer-policy/),

[Referrer-Policy |

MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy)

* **Feature:** [A new security header: Feature Policy | Scott

Helme](https://scotthelme.co.uk/a-new-security-header-feature-policy/),

[Feature-Policy |

MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy),

[Introduction to Feature Policy | Google

Developers](https://developers.google.com/web/updates/2018/06/feature-policy)

* **Cache:** [Cache-Control |

MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control)

Indices and tables[¶](#indices-and-tables "Permalink to this headline")

=======================================================================

* [Index](genindex.html)

* [Module Index](py-modindex.html)

* [Search Page](search.html)

[secure.py](index.html#document-index)

======================================

### Navigation

Contents:

* [Secure Headers](index.html#document-headers)

* [Policy Builder](index.html#document-policies)

* [Supported Frameworks](index.html#document-frameworks)

* [Resources](index.html#document-resources)

### Related Topics

* [Documentation overview](index.html#document-index)

### Quick search

 ©2021, Caleb Kinney.

 

 |

 Powered by [Sphinx 1.8.5](http://sphinx-doc.org/)

 & [Alabaster 0.7.12](https://github.com/bitprophet/alabaster)

