Fix #28: Add Permissions-Policy header middleware

commonware/response/middleware.py

@@ -64,3 +64,17 @@ def process_response(self, request, response):
         if 'X-Content-Type-Options' not in response:
             response['X-Content-Type-Options'] = 'nosniff'
         return response
+
+
+class PermissionsPolicyHeader(MiddlewareMixin):
+    """
+    Set the `Permissions-Policy: interest-cohort=()` header if no
+    `Permissions-Policy` header is in the response. This will opt
+    the site out of the FLoC protocol.
+    See https://paramdeo.com//blog/opting-your-website-out-of-googles-floc-network
+    """
+
+    def process_response(self, request, response):
+        if 'Permissions-Policy' not in response:
+            response['Permissions-Policy'] = 'interest-cohort=()'
+        return response

commonware/response/tests.py

@@ -116,3 +116,9 @@ def test_xrobots_tag_decorator():
                          middleware.RobotsTagHeader)
     assert 'X-Robots-Tag' in resp
     eq_(value, resp['X-Robots-Tag'])
+
+
+def test_permissions_policy_middleware():
+    resp = _make_resp(middleware.PermissionsPolicyHeader)
+    assert 'Permissions-Policy' in resp
+    eq_('interest-cohort=()', resp['Permissions-Policy'])