Async middleware pattern for consistent security headers in aiohttp

[cak]

I’ve been trying to clean up how we apply HTTP security headers in async Python services and landed on a simple aiohttp middleware pattern.

The main issue was inconsistency:

• headers added in some handlers but not others
• CSP drifting over time
• hard to audit what’s actually applied

Middleware ended up being the cleanest place to enforce it:

from aiohttp import web
from secure import Secure

secure_headers = Secure.with_default_headers()

@web.middleware
async def add_security_headers(request, handler):
    response = await handler(request)
    await secure_headers.set_headers_async(response)
    return response

app = web.Application(middlewares=[add_security_headers])

What I like about this:

• works cleanly with async response flow
• guarantees coverage without touching handlers
• keeps the header policy in one place

If you don’t want to wire this up each time, I wrapped the pattern here:
https://github.com/TypeError/secure

Curious if others are enforcing headers at middleware level in aiohttp or doing something different?

[Dreamsorcerer]

I typically use a middleware to apply headers like Content-Security-Policy locally during development, and then enforce it via nginx in production.