tPjSUdZddlZddlmZddlmZddlmZmZm Z m Z m Z dZ ee d<dZee d <d efd ZGd d Zy)a Adds anti-framing / content-type security headers to every HTTP response. X-Frame-Options and Content-Security-Policy: frame-ancestors 'none' stop the admin UI and login pages from being embedded cross-origin (clickjacking). X-Content-Type-Options: nosniff stops MIME sniffing. Strict-Transport-Security is opt-in via LITELLM_ENABLE_HSTS because it only makes sense over HTTPS and would lock browsers out of plain-http deployments. Headers are set with setdefault so a route that intentionally sets its own value is never overridden. N)Final)MutableHeaders)ASGIAppMessageReceiveScopeSend))zX-Frame-OptionsDENY)zContent-Security-Policyzframe-ancestors 'none')zX-Content-Type-OptionsnosniffSTATIC_SECURITY_HEADERS)zStrict-Transport-Securityz#max-age=31536000; includeSubDomains HSTS_HEADERreturncltjddjjdk(S)NLITELLM_ENABLE_HSTSfalsetrue)osgetenvstriplowery/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/middleware/security_headers_middleware.py _hsts_enabledrs+ 99*G 4 : : < B B D NNrc4eZdZdeddfdZdedededdfdZy) SecurityHeadersMiddlewareapprNc||_y)N)r)selfrs r__init__z"SecurityHeadersMiddleware.__init__"s rscopereceivesendcK|ddk7r|j||d{ydtddffd }|j|||d{y7/7w)NtypehttpmessagercK|ddk(rGt|}trgttnt}|D]\}}|j |||d{y7w)Nr%zhttp.response.start)r!)rrr r setdefault)r'headersappliednamevaluer#s rsend_with_security_headerszFSecurityHeadersMiddleware.__call__..send_with_security_headers*sfv"77!/g!>LYO!H#:!HK!Hax#*4KD%&&tU34w-  sAA&A$A&)rr)rr!r"r#r.s ` r__call__z"SecurityHeadersMiddleware.__call__%sd =F "((5'40 0 0  g $ hhug'ABBB 1 Cs!AA)A A AA) __name__ __module__ __qualname__rr rrr r/rrrrr!s;G CE CG C4 CD Crr)__doc__rtypingrstarlette.datastructuresrstarlette.typesrrrrr r __annotations__r boolrrrrrr9sQ  3BB" Z UYOtOCCr