diff --git a/commonware/response/middleware.py b/commonware/response/middleware.py index 7d0ae99..bc7be51 100644 --- a/commonware/response/middleware.py +++ b/commonware/response/middleware.py @@ -64,3 +64,17 @@ def process_response(self, request, response): if 'X-Content-Type-Options' not in response: response['X-Content-Type-Options'] = 'nosniff' return response + + +class PermissionsPolicyHeader(MiddlewareMixin): + """ + Set the `Permissions-Policy: interest-cohort=()` header if no + `Permissions-Policy` header is in the response. This will opt + the site out of the FLoC protocol. + See https://paramdeo.com//blog/opting-your-website-out-of-googles-floc-network + """ + + def process_response(self, request, response): + if 'Permissions-Policy' not in response: + response['Permissions-Policy'] = 'interest-cohort=()' + return response diff --git a/commonware/response/tests.py b/commonware/response/tests.py index a863529..c0fb85a 100644 --- a/commonware/response/tests.py +++ b/commonware/response/tests.py @@ -116,3 +116,9 @@ def test_xrobots_tag_decorator(): middleware.RobotsTagHeader) assert 'X-Robots-Tag' in resp eq_(value, resp['X-Robots-Tag']) + + +def test_permissions_policy_middleware(): + resp = _make_resp(middleware.PermissionsPolicyHeader) + assert 'Permissions-Policy' in resp + eq_('interest-cohort=()', resp['Permissions-Policy'])