Security headers

In production, when DEBUG=False, Feather adds these headers to every response. They’re on by default and skipped in development, so most apps never touch this page.

Header	Value	Purpose
`Content-Security-Policy`	Configurable directives	Controls resource loading
`Strict-Transport-Security`	`max-age=31536000; includeSubDomains`	Forces HTTPS
`X-Content-Type-Options`	`nosniff`	Prevents MIME-type sniffing
`X-Frame-Options`	`DENY`	Prevents clickjacking
`Referrer-Policy`	`strict-origin-when-cross-origin`	Controls referrer info
`Permissions-Policy`	`camera=(), microphone=(), geolocation=(), payment=()`	Restricts browser APIs

Default CSP

default-src 'self'
script-src  'self'
style-src   'self' 'unsafe-inline' https://fonts.googleapis.com
img-src     'self' data: blob: https://*.googleusercontent.com
media-src   'self' blob:
font-src    'self' https://fonts.gstatic.com
connect-src 'self'
frame-ancestors 'none'

data: and blob: are there so a page can preview a file someone has just chosen, before it is uploaded anywhere.

Files you store elsewhere

An app that keeps uploads in a bucket has to be able to show them. When S3_PUBLIC_URL or S3_ENDPOINT is set, that origin is added to img-src and media-src for you:

img-src   'self' data: blob: https://*.googleusercontent.com https://s3.example.com
media-src 'self' blob: https://s3.example.com

Nothing to configure, and a blocked image stops being the first thing you meet after building an upload page.

Extending it

Custom directives merge with the defaults, so you specify only what changes. For Stripe:

config.py

class ProductionConfig(Config):
    FEATHER_CSP_DIRECTIVES = {
        "script-src": "'self' https://js.stripe.com",
        "frame-src": "'self' https://js.stripe.com",
    }

Disabling

FEATHER_SECURITY_HEADERS = False

Not recommended. If a third-party script is blocked, add its origin to the relevant directive rather than turning off the header.

The strict script-src 'self' is why inline <script> blocks and onclick= handlers are feather check errors. Code that works in development would be blocked by CSP in production.

Get started

Tutorial: build a Kanban app

Building the UI

Backend

Features

Tooling

Testing

Deployment

Security headers

Default CSP

Files you store elsewhere

Extending it

Disabling

​Default CSP

​Files you store elsewhere

​Extending it

​Disabling

Default CSP

Files you store elsewhere

Extending it

Disabling