<commit_before>********************************
Securing CherryPy
********************************

There are several settings that can be enabled to make CherryPy pages more secure. These include:

    Transmitting data:

        #. Use Secure Cookies

    Rendering pages:

        #. Set HttpOnly cookies
        #. Set XFrame options
        #. Enable XSS Protection
        #. Set the Content Security Policy

An easy way to accomplish this is to set headers with a :doc:`Tool </tutorial/tools>` and wrap your entire CherryPy application with it::

    import cherrypy

    def secureheaders():
        headers = cherrypy.response.headers
        headers['X-Frame-Options'] = 'DENY'
        headers['X-XSS-Protection'] = '1; mode=block'
        headers['Content-Security-Policy'] = "default-src='self'"

    # set the priority according to your needs if you are hooking something
    # else on the 'before_finalize' hook point.
    cherrypy.tools.secureheaders = \
        cherrypy.Tool('before_finalize', secureheaders, priority=60)


Then, in the :doc:`configuration file </tutorial/config>` (or any other place that you want to enable the tool)::

    [/]
    tools.secureheaders.on = True


If you use :doc:`sessions </refman/lib/sessions>` you can also enable these settings::

    [/]
    tools.sessions.on = True
    # increase security on sessions
    tools.session.secure = True
    tools.sessions.httponly = True


If you use SSL you can also enable Strict Transport Security::

    #add this to secureheaders():
    headers['Strict-Transport-Security'] = 'max-age=31536000' # one year



Further Security Resources
==========================

For an introduction to webserver security see `<NAME>'s presentation from PyCon CA 2013 <http://pyvideo.org/video/2315/quick-wins-for-better-website-security>`_.
<commit_msg>Fix typo at the doc sample of the sessions with incresed security<commit_after>********************************
Securing CherryPy
********************************

There are several settings that can be enabled to make CherryPy pages more secure. These include:

    Transmitting data:

        #. Use Secure Cookies

    Rendering pages:

        #. Set HttpOnly cookies
        #. Set XFrame options
        #. Enable XSS Protection
        #. Set the Content Security Policy

An easy way to accomplish this is to set headers with a :doc:`Tool </tutorial/tools>` and wrap your entire CherryPy application with it::

    import cherrypy

    def secureheaders():
        headers = cherrypy.response.headers
        headers['X-Frame-Options'] = 'DENY'
        headers['X-XSS-Protection'] = '1; mode=block'
        headers['Content-Security-Policy'] = "default-src='self'"

    # set the priority according to your needs if you are hooking something
    # else on the 'before_finalize' hook point.
    cherrypy.tools.secureheaders = \
        cherrypy.Tool('before_finalize', secureheaders, priority=60)


Then, in the :doc:`configuration file </tutorial/config>` (or any other place that you want to enable the tool)::

    [/]
    tools.secureheaders.on = True


If you use :doc:`sessions </refman/lib/sessions>` you can also enable these settings::

    [/]
    tools.sessions.on = True
    # increase security on sessions
    tools.sessions.secure = True
    tools.sessions.httponly = True


If you use SSL you can also enable Strict Transport Security::

    #add this to secureheaders():
    headers['Strict-Transport-Security'] = 'max-age=31536000' # one year



Further Security Resources
==========================

For an introduction to webserver security see `<NAME>'s presentation from PyCon CA 2013 <http://pyvideo.org/video/2315/quick-wins-for-better-website-security>`_.

{'fraction_non_alphanumeric': 0.1365958591019091, 'fraction_numerical': 0.010217800484001076, 'mean_word_length': 3.4180522565320666, 'pattern_counts': {'":': 0, '<': 13, '<?xml version=': 0, '>': 13, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2121095', 'n_tokens_mistral': 1076, 'n_tokens_neox': 957, 'n_words': 357}