Challenge 1: Write a Security-Header Middleware — Possible Solution
====================================================================

# catalog/middleware.py

def nosniff_header_middleware(get_response):
    def middleware(request):
        response = get_response(request)
        response["X-Content-Type-Options"] = "nosniff"
        return response
    return middleware

# settings.py

MIDDLEWARE = [
    "django.middleware.security.SecurityMiddleware",
    "catalog.middleware.nosniff_header_middleware",   # placed right after SecurityMiddleware
    "django.contrib.sessions.middleware.SessionMiddleware",
    "django.middleware.csrf.CsrfViewMiddleware",
    "django.contrib.auth.middleware.AuthenticationMiddleware",
    "django.contrib.messages.middleware.MessageMiddleware",
]

WHY THIS ORDER
--------------
Placing nosniff_header_middleware immediately after SecurityMiddleware
groups it logically with Django's own security-related middleware, which
also adds/manages response headers. Because request processing runs
top-to-bottom and response processing runs bottom-to-top (the "onion"
model from the chapter), the EXACT position relative to
SecurityMiddleware doesn't functionally matter much for a header this
simple — but keeping security-header middleware together, near the top of
the list, makes the settings.py file easier for a future reader to scan
and understand what's protecting the app.

WHY THIS WORKS
--------------
- This middleware does nothing on the "request" side — it calls
  get_response(request) immediately, with no code before that call —
  because the header only needs to be added to the outgoing RESPONSE,
  not read from or modified on the incoming request.
- response["X-Content-Type-Options"] = "nosniff" sets an HTTP response
  header using Django's HttpResponse's dict-like header-setting syntax —
  this header tells browsers not to try to "guess" a different MIME type
  than what the server declared, closing off a class of content-sniffing
  based attacks (relevant to both the XSS course and general hardening
  practice).
- Every response passing through this middleware gets the header added,
  regardless of which view produced it — this is exactly the "project-wide,
  not per-view" property that makes middleware the right tool for a
  blanket security header, rather than adding it manually inside every
  individual view function.