Any chance of setting security headers in apache?
HTTP Security Header Header Role Status
X-Frame-Options Protects against Clickjacking attacks Not set
X-XSS-Protection Mitigates Cross-Site Scripting (XSS) attacks Not set
Strict-Transport-Security Protects against man-in-the-middle attacks Not set
X-Content-Type-Options Prevents possible phishing or XSS attacks Not set
As far as I know, Home Assistant doesn’t use Apache at all.
Okie dokie, I thought it was a python driven apache webserver.
Either way, still could do with having the Security Headers sorted for that little extra security.
Home Assistant uses AIOHTTP
For more details about this component, please refer to the documentation at
https://home-assistant.io/components/http/
"""
from ipaddress import ip_network
import logging
import os
import ssl
from typing import Optional
from aiohttp import web
from aiohttp.web_exceptions import HTTPMovedPermanently
import voluptuous as vol
from homeassistant.const import (
EVENT_HOMEASSISTANT_START, EVENT_HOMEASSISTANT_STOP, SERVER_PORT)
import homeassistant.helpers.config_validation as cv
import homeassistant.util as hass_util
from homeassistant.util.logging import HideSensitiveDataFilter
from homeassistant.util import ssl as ssl_util
Feel free to submit a pull request.
