pk/atst
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

On fix unsafe-eval header and websockets on development

Browse Source
This commit is contained in:
George Drummond 2018-12-13 13:54:19 -05:00
parent 5da374bbc9
commit ec09c27a38
No known key found for this signature in database
GPG Key ID: 296DD6077123BF17
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
atst/app.py
View File

@ -98,11 +98,15 @@ def set_default_headers(app):
response.headers[
"Strict-Transport-Security"
] = "max-age=31536000; includeSubDomains"
response.headers["Content-Security-Policy"] = "default-src 'self'"
response.headers["X-Content-Type-Options"] = "nosniff"
response.headers["X-Frame-Options"] = "SAMEORIGIN"
response.headers["X-XSS-Protection"] = "1; mode=block"
if ENV == 'dev':
response.headers["Content-Security-Policy"] = "default-src 'self' 'unsafe-eval'; connect-src *"
else:
response.headers["Content-Security-Policy"] = "default-src 'self' 'unsafe-eval'"
return response