Function _security_headers

Scripts/ButSystem.py:1616–1720

_security_headers. Internal helper function. This docstring was expanded to make future maintenance easier. Args: resp: Parameter. Returns: Varies.

(resp)

    # If neither header is present, don't block legitimate requests.
    if not origin and not ref:
        return True

    def _netloc(h: str) -> Optional[str]:
        try:
            p = urlparse(h)
            return (p.netloc or "").lower()
        except Exception:
            return None

    if origin:
        n = _netloc(origin)
        if not n:
            return False
        if n != expected:
            return False

    if ref:
        n = _netloc(ref)
        if not n:
            return False
        if n != expected:
            return False

    return True
    return True

@app.before_request
def _set_security_context():
    # Nonce is useful if you later decide to tighten CSP (remove unsafe-inline).
    """_set_security_context.

Internal helper function.

This docstring was expanded to make future maintenance easier.

Returns:
    Varies.
"""
    # Nonce is useful if you later decide to tighten CSP (remove unsafe-inline).
    g.csp_nonce = secrets.token_urlsafe(16)
    # Ensure token exists early so templates can reference it.
    g.csrf_token = csrf_token()

@app.before_request
def _validate_host_header():
    try:
        host = (request.host or "").split(":", 1)[0].strip().strip("[]")
    except Exception:
        host = ""
    if not _host_is_allowed(host):
        log_security_event("blocked_host_header", detail=f"host={host or '?'}", level="warning")
        abort(400)
    return None

@app.before_request
def _csrf_protect():
    """_csrf_protect.