> Fetch clean Markdown by appending `.md` to any page URL under https://signalwire.com/docs or requesting it with the HTTP header `Accept: text/markdown`. The root index at https://signalwire.com/docs/llms.txt lists the available documentation indexes. # SecurityConfig > Unified security configuration for SSL, CORS, host allowlists, and rate limiting. [getbasicauth]: /docs/server-sdks/reference/python/agents/configuration/security-config/get-basic-auth [getcorsconfig]: /docs/server-sdks/reference/python/agents/configuration/security-config/get-cors-config [getsecurityheaders]: /docs/server-sdks/reference/python/agents/configuration/security-config/get-security-headers [getsslcontextkwargs]: /docs/server-sdks/reference/python/agents/configuration/security-config/get-ssl-context-kwargs [geturlscheme]: /docs/server-sdks/reference/python/agents/configuration/security-config/get-url-scheme [loadfromenv]: /docs/server-sdks/reference/python/agents/configuration/security-config/load-from-env [logconfig]: /docs/server-sdks/reference/python/agents/configuration/security-config/log-config [shouldallowhost]: /docs/server-sdks/reference/python/agents/configuration/security-config/should-allow-host [validatesslconfig]: /docs/server-sdks/reference/python/agents/configuration/security-config/validate-ssl-config `SecurityConfig` provides centralized security settings for all SignalWire services. It loads settings from environment variables and optional config files, handling SSL/TLS, CORS, host allowlists, rate limiting, HSTS, and basic authentication credentials. ```python from signalwire.core.security_config import SecurityConfig ``` A global default instance is available at `signalwire.core.security_config.security_config` for backward compatibility. Services can create their own instances with service-specific config files. ## **Properties** **`ssl_enabled`** `bool` — default: false Whether HTTPS is enabled. --- **`ssl_cert_path`** `str | None` — default: None Path to the SSL certificate file. Required when `ssl_enabled` is `True`. --- **`ssl_key_path`** `str | None` — default: None Path to the SSL private key file. Required when `ssl_enabled` is `True`. --- **`domain`** `str | None` — default: None Domain name for SSL certificates and URL generation. --- **`ssl_verify_mode`** `str` — default: CERT\_REQUIRED SSL certificate verification mode. --- **`allowed_hosts`** `list[str]` — default: \["\*"] List of allowed hostnames. `["*"]` accepts all hosts. --- **`cors_origins`** `list[str]` — default: \["\*"] List of allowed CORS origins. `["*"]` accepts all origins. --- **`max_request_size`** `int` — default: 10485760 Maximum request body size in bytes (default 10 MB). --- **`rate_limit`** `int` — default: 60 Rate limit in requests per minute. --- **`request_timeout`** `int` — default: 30 Request timeout in seconds. --- **`use_hsts`** `bool` — default: true Enable HTTP Strict Transport Security when serving over HTTPS. --- **`hsts_max_age`** `int` — default: 31536000 HSTS `max-age` in seconds (default 1 year). --- **`basic_auth_user`** `str | None` — default: None Basic auth username. Defaults to `"signalwire"` when accessed via `get_basic_auth()`. --- **`basic_auth_password`** `str | None` — default: None Basic auth password. Auto-generated if not set when accessed via `get_basic_auth()`. --- ## **Methods** #### [get\_basic\_auth](/docs/server-sdks/reference/python/agents/configuration/security-config/get-basic-auth) Get basic authentication credentials, generating a password if not set. #### [get\_cors\_config](/docs/server-sdks/reference/python/agents/configuration/security-config/get-cors-config) Get CORS configuration suitable for FastAPI's CORSMiddleware. #### [get\_security\_headers](/docs/server-sdks/reference/python/agents/configuration/security-config/get-security-headers) Get security headers to add to HTTP responses. #### [get\_ssl\_context\_kwargs](/docs/server-sdks/reference/python/agents/configuration/security-config/get-ssl-context-kwargs) Get SSL parameters suitable for passing to uvicorn. #### [get\_url\_scheme](/docs/server-sdks/reference/python/agents/configuration/security-config/get-url-scheme) Get the URL scheme based on SSL configuration. #### [load\_from\_env](/docs/server-sdks/reference/python/agents/configuration/security-config/load-from-env) Reload all settings from environment variables. #### [log\_config](/docs/server-sdks/reference/python/agents/configuration/security-config/log-config) Log the current security configuration for debugging. #### [should\_allow\_host](/docs/server-sdks/reference/python/agents/configuration/security-config/should-allow-host) Check if a host is in the allowed hosts list. #### [validate\_ssl\_config](/docs/server-sdks/reference/python/agents/configuration/security-config/validate-ssl-config) Validate that SSL configuration is complete and certificate files exist. ## **Example** ```python {4,8,11} from signalwire.core.security_config import SecurityConfig # Auto-discover config file security = SecurityConfig() print(f"SSL: {security.ssl_enabled}, HSTS: {security.use_hsts}") # Explicit config file security = SecurityConfig(config_file="/etc/myapp/config.json") # Service-specific config security = SecurityConfig(service_name="mcp") ``` > Unified security configuration for SSL, CORS, host allowlists, and rate limiting. ## Docs - [get_basic_auth](https://signalwire.com/docs/server-sdks/reference/python/agents/configuration/security-config/get-basic-auth.md): Get basic authentication credentials, generating a password if not set. - [get_cors_config](https://signalwire.com/docs/server-sdks/reference/python/agents/configuration/security-config/get-cors-config.md): Get CORS configuration suitable for FastAPI's CORSMiddleware. - [get_security_headers](https://signalwire.com/docs/server-sdks/reference/python/agents/configuration/security-config/get-security-headers.md): Get security headers to add to HTTP responses. - [get_ssl_context_kwargs](https://signalwire.com/docs/server-sdks/reference/python/agents/configuration/security-config/get-ssl-context-kwargs.md): Get SSL parameters suitable for passing to uvicorn. - [get_url_scheme](https://signalwire.com/docs/server-sdks/reference/python/agents/configuration/security-config/get-url-scheme.md): Get the URL scheme based on SSL configuration. - [load_from_env](https://signalwire.com/docs/server-sdks/reference/python/agents/configuration/security-config/load-from-env.md): Reload all settings from environment variables. - [log_config](https://signalwire.com/docs/server-sdks/reference/python/agents/configuration/security-config/log-config.md): Log the current security configuration for debugging. - [should_allow_host](https://signalwire.com/docs/server-sdks/reference/python/agents/configuration/security-config/should-allow-host.md): Check if a host is in the allowed hosts list. - [validate_ssl_config](https://signalwire.com/docs/server-sdks/reference/python/agents/configuration/security-config/validate-ssl-config.md): Validate that SSL configuration is complete and certificate files exist.