Default headers with FastAPI docs

[remimd]

Using SecureASGIMiddleware with Secure.with_default_headers() on a FastAPI app breaks /docs and /redoc: the BALANCED CSP blocks the CDN-hosted JS/CSS and inline styles those pages rely on.

Is there an existing solution I missed, or would it make sense to add something like a Secure.allow_fastapi_docs() method?

[yxtay]

My workaround.

app = FastAPI()
secure_headers = secure.Secure.with_default_headers()

@app.middleware("http")
async def set_secure_headers(
    request: Request, call_next: Callable[[Request], Awaitable[Response]]
) -> Response:
    response = await call_next(request)

    # Allow unsafe-inline styles only for /docs and /redoc
    if request.url.path in ["/docs", "/redoc", "/openapi.json"]:
        # Don't apply strict CSP to docs pages
        pass
    else:
        await secure_headers.set_headers_async(response)

    return response

[remimd]

Would adding an exclude_paths parameter to SecureASGIMiddleware / SecureWSGIMiddleware be a welcome addition? Seems like a small, framework-agnostic way to cover this use case without requiring users to drop the middleware entirely.