2016-01-07 13:58:38 +00:00
|
|
|
|
2016-01-15 15:15:35 +00:00
|
|
|
def test_owasp_useful_headers_set(app_):
|
|
|
|
|
with app_.test_request_context():
|
|
|
|
|
response = app_.test_client().get('/')
|
2016-01-07 13:58:38 +00:00
|
|
|
assert response.status_code == 200
|
|
|
|
|
assert response.headers['X-Frame-Options'] == 'deny'
|
|
|
|
|
assert response.headers['X-Content-Type-Options'] == 'nosniff'
|
|
|
|
|
assert response.headers['X-XSS-Protection'] == '1; mode=block'
|
2016-01-13 10:37:34 +00:00
|
|
|
assert response.headers['Content-Security-Policy'] == "default-src 'self' 'unsafe-inline'; font-src 'self' data:;" # noqa
|
