Secweb
Secweb is a pack of security middlewares for fastApi and starlette servers it includes CSP, HSTS, and many more
Decision gist · record as of 2026-08-14
Yes. Secweb is worth installing if you use Starlette and want security headers without external dependencies or complex configuration. It is actively maintained, has no known vulnerabilities, and offers both simplicity (one-line setup) and flexibility (per-header customization). The MPL-2.0 license is permissive for use; only modifications to the package itself trigger copyleft obligations. The main consideration is the Python >= 3.10 requirement.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python >= 3.10 and Starlette.
- Low install friction: pure Python wheel with no runtime dependencies.
- Active maintenance with a recent release (15 days old) and steady repository activity.
License · maintenance · safety
MPL-2.0 (copyleft) — Licensed under MPL-2.0 (copyleft). You must disclose source code modifications and distribute under the same license if you modify the package itself, though using it unmodified in your application does not trigger these obligations.
last release 2026-07-30 (15 days) · last repo commit 2026-07-31 · 82 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 361,236 downloads/mo, #7,240 on PyPI
Alternatives
Verify before relying
pip install Secweb
from Secweb import SecWeb
SecWeb(app=app)- Whether the 16 headers listed in the description are all implemented in version 2.0.0 or if some (like PermissionsPolicy) remain in development.
- Whether nonce generation for CSP is cryptographically sound and suitable for production use.
- Whether the package works with frameworks other than those built on Starlette.
What it is and what it does
Secweb is a middleware package that automatically injects security headers into Starlette-based application responses. It provides 16 security headers including Content-Security-Policy, HTTP Strict Transport Security, X-Frame-Options, and others, with sensible defaults aligned to MDN and OWASP recommendations. You can use it as a single SecWeb class that applies all headers at once, or import individual header functions to apply only what you need. Headers are customizable via an options dictionary, and some support advanced features like nonce generation for inline scripts and styles, or report-only modes for testing policies without enforcement.
The package has no external runtime dependencies beyond Starlette itself, making it lightweight to add to existing projects. Configuration is minimal—often just a single line—but flexible enough to disable specific headers or override defaults. It targets Python >= 3.10 and is actively maintained.
Use it for
- Add CSP, HSTS, and clickjacking protection to a Starlette application in one call without writing middleware boilerplate.
- Gradually roll out a Content-Security-Policy by enabling report-only mode to collect violations before enforcing.
- Generate per-request nonces for inline scripts and styles in a template route to allow CSP while keeping inline code.
- Protect a Starlette application with security headers when you cannot or do not want to use a reverse proxy.
- Customize individual security policies (e.g., set HSTS max-age or Cache-Control directives) while keeping others at defaults.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes.
Secweb is worth installing if you use Starlette and want security headers without external dependencies or complex configuration. It is actively maintained, has no known vulnerabilities, and offers both simplicity (one-line setup) and flexibility (per-header customization). The MPL-2.0 license is permissive for use; only modifications to the package itself trigger copyleft obligations. The main consideration is the Python >= 3.10 requirement.
Install
secweb on PyPI
Before you install
Low install friction: pure Python wheel with no runtime dependencies. Active maintenance with a recent release (15 days old) and steady repository activity.
Requires Python >= 3.10 and Starlette.
License in practice
Licensed under MPL-2.0 (copyleft). You must disclose source code modifications and distribute under the same license if you modify the package itself, though using it unmodified in your application does not trigger these obligations.
Quickstart
pip install Secweb
from Secweb import SecWeb
SecWeb(app=app)Verify before relying
- Whether the 16 headers listed in the description are all implemented in version 2.0.0 or if some (like PermissionsPolicy) remain in development.
- Whether nonce generation for CSP is cryptographically sound and suitable for production use.
- Whether the package works with frameworks other than those built on Starlette.
Package facts
| License | MPL-2.0 copyleft |
| Python support | Supports the current Python release >=3.10 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | None |
| Maintenance | Actively maintained 15 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 361,236 / month, #7,240 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 5 - Production/StableIntended Audience :: DevelopersOperating System :: OS IndependentProgramming Language :: Python :: 3 |
Evidence: secweb-2.0.0-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “starlette security headers”
- SecwebSecweb applies security headers (CSP, HSTS, X-Frame-Options, and 13…
- starlette-contextMiddleware for Starlette that stores and accesses request context…
- starlette-exporterCollects and exports Prometheus metrics for Starlette and FastAPI…
Give your agent the search over MCP, or paste the wish link into any chat.
More Security packages
Provides Python bindings to the FreeDesktop.org Secret Service API for securely storing and retrieving passwords and secrets through GNOME Keyring, KWallet, or KeePassXC.
MSAL for Python handles OAuth2 and OpenID Connect authentication with Microsoft identity services, managing token acquisition, caching, and refresh for applications integrating with Microsoft Entra ID, Microsoft Accounts, and Azure AD B2C.
joserfc implements JOSE standards (JWS, JWE, JWK, JWT, and related RFCs) for signing, encrypting, and managing JSON-based cryptographic tokens in Python.
Authlib provides a complete implementation of OAuth 1.0, OAuth 2.0, and OpenID Connect 1.0 for building both authentication clients and servers, with built-in support for JWS, JWK, JWA, and JWT standards.
Provides low-level CFFI bindings to the official Argon2 password hashing algorithm for use by libraries and applications that need direct access to Argon2 without higher-level abstractions.
ADAL for Python authenticates applications with Azure Active Directory to obtain tokens for accessing Azure AD-protected resources.
Install only if maintaining existing code that already depends on it, and plan a migration.
See also secure · hstspreload · django-csp · starlette-context · starlette-csrf · flask-talisman · starlette-compress · sse-starlette · django-permissions-policy · starlette-exporter