[Feature]: Add various security headers #3677
Description
The Feature
LiteLLM should add the following headers:
content-security-policycross-origin-resource-policycross-origin-opener-policycross-origin-embedder-policyx-frame-optionsx-content-type-optionsaccess-control-allow-origin
IMO should use PROXY_BASE_URL as a default to calculate these headers.
Reasonable defaults for all requests/paths would be (assuming PROXY_BASE_URL="https://example.com/":
x-content-type-options: nosniff
x-frame-options: DENY
cross-origin-resource-policy: same-origin
cross-origin-opener-policy: same-origin
cross-origin-embedder-policy: require-corp
access-control-allow-origin: https://example.com
The CSP is a bit more complicated. For example, the CSP for https://example.com/v1/chat/completions and https://example.com/ui will be completely different.
This is an UNSAFE/bad example of a CSP for LiteLLM:
content-security-policy: default-src * 'unsafe-inline'; img-src * 'self' data:
Motivation, pitch
Security hardening of LiteLLM is always a good idea imo. =)