Got basic webpage working. Need to make base page, static folders

2018-01-20 13:16:20 -08:00
parent 982037efc1
commit 1a375726ae
5625 changed files with 577078 additions and 0 deletions
@@ -0,0 +1,46 @@
+import re
+
+from django.conf import settings
+from django.http import HttpResponsePermanentRedirect
+from django.utils.deprecation import MiddlewareMixin
+
+
+class SecurityMiddleware(MiddlewareMixin):
+    def __init__(self, get_response=None):
+        self.sts_seconds = settings.SECURE_HSTS_SECONDS
+        self.sts_include_subdomains = settings.SECURE_HSTS_INCLUDE_SUBDOMAINS
+        self.sts_preload = settings.SECURE_HSTS_PRELOAD
+        self.content_type_nosniff = settings.SECURE_CONTENT_TYPE_NOSNIFF
+        self.xss_filter = settings.SECURE_BROWSER_XSS_FILTER
+        self.redirect = settings.SECURE_SSL_REDIRECT
+        self.redirect_host = settings.SECURE_SSL_HOST
+        self.redirect_exempt = [re.compile(r) for r in settings.SECURE_REDIRECT_EXEMPT]
+        self.get_response = get_response
+
+    def process_request(self, request):
+        path = request.path.lstrip("/")
+        if (self.redirect and not request.is_secure() and
+                not any(pattern.search(path)
+                        for pattern in self.redirect_exempt)):
+            host = self.redirect_host or request.get_host()
+            return HttpResponsePermanentRedirect(
+                "https://%s%s" % (host, request.get_full_path())
+            )
+
+    def process_response(self, request, response):
+        if (self.sts_seconds and request.is_secure() and
+                'strict-transport-security' not in response):
+            sts_header = "max-age=%s" % self.sts_seconds
+            if self.sts_include_subdomains:
+                sts_header = sts_header + "; includeSubDomains"
+            if self.sts_preload:
+                sts_header = sts_header + "; preload"
+            response["strict-transport-security"] = sts_header
+
+        if self.content_type_nosniff and 'x-content-type-options' not in response:
+            response["x-content-type-options"] = "nosniff"
+
+        if self.xss_filter and 'x-xss-protection' not in response:
+            response["x-xss-protection"] = "1; mode=block"
+
+        return response