TypeError / secure

Lightweight modern Python library to add security headers (CSP, HSTS, etc.) to Django, Flask, FastAPI, and more. Secure defaults or fully customizable.
MIT License
895 stars 27 forks source link

Permission policy updates #17

Closed VijoPlays closed 3 years ago

VijoPlays commented 3 years ago

Just integrated 'secure' into my flask app, and the documentation has been very useful (thank you!). One adjustment I'd make to the docs, is to mention that leaving a policy empty, like

    secure.PermissionsPolicy()
    .accelerometer()

means it's being disabled.


The main reason I made this issue though, is the missing permission policies.

I don't know whether they are new or not, either way, would be dope to have them added to 'secure' as well.

Apart from the proposed/experimental tabs, the ones I've found are missing are the following ones:

And I assume

are outdated, since they also throw errors when I attempt to use them?

VijoPlays commented 3 years ago

And I also just checked, the "ambient-light-sensor" is misconfigured slightly:

ambient-light-sensor =()

The space between the brackets and the ALS make it throw an error (and the speaker one throws a warning (not recognized), though that might just be an issue on my end).

VijoPlays commented 3 years ago

And the CSP header is also missing the

"prefetch-src"

attribute.

Again though, the library is very nice thus far!

cak commented 3 years ago

Thanks for the feedback and filing this issue! 🤩 I'll get these updated! 🚀

Please keep the suggestions coming!