# Configuration (CWE-16)

Weaknesses in this category are typically introduced during the configuration of the product.

- Prevalence: Élevée Fréquemment exploitée
- Impact: Moyen Revue recommandée
- Prevention: Documentée 1 exemples de correctifs

**OWASP:** Security Misconfiguration (A05:2021-Security Misconfiguration) - #5

## Description

Configuration weaknesses occur when the product is set up in a way that exposes security vulnerabilities. This includes insecure default settings, missing security headers, or improper feature flags.

## Prevention

### Key Practices

- configured at the application
level, not in individual view handlers

### Python

Add HSTS, X-Content-Type-Options, X-Frame-Options, and CSP via middleware

## Warning Signs

- [MEDIUM] Application missing important security headers
- [MEDIUM] missing security headers like HSTS, X-Content-Type-Options,
X-XSS-Protection, Referrer-Policy, and P

## Consequences

- Contourner le mécanisme de protection
- Lecture des données de l'application
- Obtenir des privilèges

## Mitigations

- Utilisez des valeurs par défaut sécurisées pour toutes les options de configuration
- Implémentez les en-têtes de sécurité (CSP, HSTS, X-Frame-Options, etc.)
- Auditez et durcissez régulièrement les configurations

## Detection

- Total rules: 1
- Languages: python

## Rules by Language

### Python (1 rules)

- **Missing Security Headers** [MEDIUM]: Detects missing security headers like HSTS, X-Content-Type-Options,
X-XSS-Protection, Referrer-Policy, and Permissions-Policy. These headers
provide defense-in-depth against various attacks.

NOTE: This rule only applies to app setup files (settings.py, middleware,
app.py, etc.). Security headers should be configured at the application
level, not in individual view handlers.
  - Remediation: Add security headers via middleware: HSTS, X-Content-Type-Options, X-Frame-Options, and CSP.

```python
from flask import Flask

app = Flask(__name__)

@app.after_request
def set_security_headers(response):
    response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
    response.headers['X-Content-Type-Options'] = 'nosniff'
    response.headers['X-Frame-Options'] = 'DENY'
    response.headers['Content-Security-Policy'] = "default-src 'self'"
    return response
```

Learn more: https://shoulder.dev/learn/python/cwe-16/missing-security-headers