TP2000-1642 Missing application security header (#1378)

* Extend security middleware

* Move to middleware file rather than new folder

common/middleware.py

@@ -1,4 +1,5 @@
 from django.conf import settings
+from django.middleware.security import SecurityMiddleware
 from django.shortcuts import redirect
 from django.urls import reverse
 
@@ -16,3 +17,13 @@ def __call__(self, request):
 
         response = self.get_response(request)
         return response
+
+
+class CustomSecurityMiddleware(SecurityMiddleware):
+    """Extends the security middleware to include the X-Permitted-Cross-Domain-
+    Policies HTTP response header."""
+
+    def process_response(self, request, response):
+        response = super().process_response(request, response)
+        response["X-Permitted-Cross-Domain-Policies"] = "none"
+        return response

settings/common.py

@@ -155,7 +155,7 @@
 ]
 
 MIDDLEWARE = [
-    "django.middleware.security.SecurityMiddleware",
+    "common.middleware.CustomSecurityMiddleware",
     "whitenoise.middleware.WhiteNoiseMiddleware",
     "django.contrib.sessions.middleware.SessionMiddleware",
     "django.middleware.common.CommonMiddleware",