incremental
diff --git a/src/security_headers_middleware.cpp b/src/security_headers_middleware.cpp
new file mode 100644
index 0000000..bcaa87d
--- /dev/null
+++ b/src/security_headers_middleware.cpp
@@ -0,0 +1,20 @@
+#include <security_headers_middleware.hpp>
+
+namespace crow {
+
+void SecurityHeadersMiddleware::before_handle(crow::request& req, response& res,
+ context& ctx) {}
+
+void SecurityHeadersMiddleware::after_handle(request& /*req*/, response& res,
+ context& ctx) {
+ // TODO(ed) these should really check content types. for example, X-UA-Compatible
+ // header doesn't make sense when retrieving a JSON or javascript file. It doesn't
+ // hurt anything, it's just ugly.
+ res.set_header("Strict-Transport-Security",
+ "max-age=31536000; includeSubdomains; preload");
+ res.set_header("X-UA-Compatible", "IE=11");
+ res.set_header("X-Frame-Options", "DENY");
+ res.set_header("X-XSS-Protection", "1; mode=block");
+ res.set_header("X-Content-Security-Policy", "default-src 'self'");
+}
+}