Fix Security Misconfiguration in Sanic

from sanic import Sanic, response
app = Sanic(“MyVulnerableApp”)
@app.route(”/”)
async def test(request):
return response.json({“hello”: “world”})
if name == “main”:
# VULNERABILITIES:
# 1. debug=True: Leaks detailed stack traces on 500 errors.
# 2. auto_reload=True: High overhead and potential for exploitation.
# 3. host=“0.0.0.0”: Listens on all interfaces, exposing the app to the public internet.
app.run(host=“0.0.0.0”, port=8000, debug=True, auto_reload=True)

from sanic import Sanic, response
import os
app = Sanic(“MySecureApp”)
@app.middleware(“response”)
async def add_security_headers(request, response):
response.headers[“Content-Security-Policy”] = “default-src ‘self’”
response.headers[“X-Frame-Options”] = “DENY”
response.headers[“X-Content-Type-Options”] = “nosniff”
response.headers[“Strict-Transport-Security”] = “max-age=31536000; includeSubDomains”
@app.route(”/”)
async def test(request):
return response.json({“status”: “hardened”})
if name == “main”:
# SECURE CONFIGURATION:
# 1. debug=False: Disables traceback leakage.
# 2. access_log=False: Reduces I/O and prevents logging sensitive data unless explicitly handled.
# 3. host=“127.0.0.1”: Binds to localhost; use a reverse proxy like Nginx for public traffic.
# 4. workers: Explicitly define process count for stability.
app.run(
host=“127.0.0.1”,
port=8000,
debug=False,
access_log=False,
workers=os.cpu_count(),
motd=False
)