SecurityConfig | SignalWire

SecurityConfig provides centralized security settings for all SignalWire services. It loads settings from environment variables and optional config files, handling SSL/TLS, CORS, host allowlists, rate limiting, HSTS, and basic authentication credentials.

from signalwire.core.security_config import SecurityConfig

A global default instance is available at signalwire.core.security_config.security_config for backward compatibility. Services can create their own instances with service-specific config files.

Properties

ssl_enabled

boolDefaults to false

Whether HTTPS is enabled.

ssl_cert_path

str | NoneDefaults to None

Path to the SSL certificate file. Required when ssl_enabled is True.

ssl_key_path

str | NoneDefaults to None

Path to the SSL private key file. Required when ssl_enabled is True.

domain

str | NoneDefaults to None

Domain name for SSL certificates and URL generation.

ssl_verify_mode

strDefaults to CERT_REQUIRED

SSL certificate verification mode.

allowed_hosts

list[str]Defaults to ["*"]

List of allowed hostnames. ["*"] accepts all hosts.

cors_origins

list[str]Defaults to ["*"]

List of allowed CORS origins. ["*"] accepts all origins.

max_request_size

intDefaults to 10485760

Maximum request body size in bytes (default 10 MB).

rate_limit

intDefaults to 60

Rate limit in requests per minute.

request_timeout

intDefaults to 30

Request timeout in seconds.

use_hsts

boolDefaults to true

Enable HTTP Strict Transport Security when serving over HTTPS.

hsts_max_age

intDefaults to 31536000

HSTS max-age in seconds (default 1 year).

basic_auth_user

str | NoneDefaults to None

Basic auth username. Defaults to "signalwire" when accessed via get_basic_auth().

basic_auth_password

str | NoneDefaults to None

Basic auth password. Auto-generated if not set when accessed via get_basic_auth().

Methods

get_basic_auth

Get basic authentication credentials, generating a password if not set.

get_cors_config

Get CORS configuration suitable for FastAPI’s CORSMiddleware.

get_security_headers

Get security headers to add to HTTP responses.

get_ssl_context_kwargs

Get SSL parameters suitable for passing to uvicorn.

get_url_scheme

Get the URL scheme based on SSL configuration.

load_from_env

Reload all settings from environment variables.

log_config

Log the current security configuration for debugging.

should_allow_host

Check if a host is in the allowed hosts list.

validate_ssl_config

Validate that SSL configuration is complete and certificate files exist.

Example

from signalwire.core.security_config import SecurityConfig
# Auto-discover config file
security = SecurityConfig()
print(f"SSL: {security.ssl_enabled}, HSTS: {security.use_hsts}")
# Explicit config file
security = SecurityConfig(config_file="/etc/myapp/config.json")
# Service-specific config
security = SecurityConfig(service_name="mcp")