Add security Middleware (#129)

amt/middleware/security.py

@@ -0,0 +1,16 @@
+import typing
+
+from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.requests import Request
+from starlette.responses import Response
+
+RequestResponseEndpoint = typing.Callable[[Request], typing.Awaitable[Response]]
+
+
+class SecurityMiddleware(BaseHTTPMiddleware):
+    async def dispatch(self, request: Request, call_next: RequestResponseEndpoint) -> Response:
+        response = await call_next(request)
+
+        response.headers["Strict-Transport-Security"] = "Strict-Transport-Security: max-age=31536000; includeSubDomains"
+
+        return response

amt/server.py

@@ -23,6 +23,7 @@
 from .middleware.csrf import CSRFMiddleware, CSRFMiddlewareExceptionHandler
 from .middleware.htmx import HTMXMiddleware
 from .middleware.route_logging import RequestLoggingMiddleware
+from .middleware.security import SecurityMiddleware
 
 configure_logging(get_settings().LOGGING_LEVEL, get_settings().LOGGING_CONFIG)
 
@@ -57,6 +58,7 @@ def create_app() -> FastAPI:
     app.add_middleware(CSRFMiddleware)
     app.add_middleware(CSRFMiddlewareExceptionHandler)
     app.add_middleware(HTMXMiddleware)
+    app.add_middleware(SecurityMiddleware)
 
     app.mount("/static", static_files, name="static")