# Configuration (CWE-16)

Weaknesses in this category are typically introduced during the configuration of the product.

- Prevalence: 높음 자주 악용됨
- Impact: 보통 검토 권장
- Prevention: 문서화됨 1개의 수정 예시

**OWASP:** Security Misconfiguration (A05:2021-Security Misconfiguration) - #5

## Description

Configuration weaknesses occur when the product is set up in a way that exposes security vulnerabilities. This includes insecure default settings, missing security headers, or improper feature flags.

## Prevention

### Key Practices

- configured at the application
level, not in individual view handlers

### Python

Add HSTS, X-Content-Type-Options, X-Frame-Options, and CSP via middleware

## Warning Signs

- [MEDIUM] Application missing important security headers
- [MEDIUM] missing security headers like HSTS, X-Content-Type-Options,
X-XSS-Protection, Referrer-Policy, and P

## Consequences

- 보호 메커니즘 우회
- 애플리케이션 데이터 읽기
- 권한 획득

## Mitigations

- 모든 구성 옵션에 안전한 기본값을 사용하세요
- 보안 헤더(CSP, HSTS, X-Frame-Options 등)를 구현하세요
- 정기적으로 구성을 감사하고 강화하세요

## Detection

- Total rules: 1
- Languages: python

## Rules by Language

### Python (1 rules)

- **Missing Security Headers** [MEDIUM]: Detects missing security headers like HSTS, X-Content-Type-Options,
X-XSS-Protection, Referrer-Policy, and Permissions-Policy. These headers
provide defense-in-depth against various attacks.

NOTE: This rule only applies to app setup files (settings.py, middleware,
app.py, etc.). Security headers should be configured at the application
level, not in individual view handlers.
  - Remediation: Add security headers via middleware: HSTS, X-Content-Type-Options, X-Frame-Options, and CSP.

```python
from flask import Flask

app = Flask(__name__)

@app.after_request
def set_security_headers(response):
    response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
    response.headers['X-Content-Type-Options'] = 'nosniff'
    response.headers['X-Frame-Options'] = 'DENY'
    response.headers['Content-Security-Policy'] = "default-src 'self'"
    return response
```

Learn more: https://shoulder.dev/learn/python/cwe-16/missing-security-headers