darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-09-08 08:28:15 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #67 from alphagov/content-security

Browse Source 
Added content security policy header.
This commit is contained in:
Rebecca Law
2016-01-12 11:35:42 +00:00
parent 7190513dc2 886d0c8c95
commit 6d12953cce
2 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/__init__.py
View File

@@ -123,6 +123,8 @@ def useful_headers_after_request(response):
response.headers.add('X-Frame-Options', 'deny') response.headers.add('X-Frame-Options', 'deny')
response.headers.add('X-Content-Type-Options', 'nosniff') response.headers.add('X-Content-Type-Options', 'nosniff')
response.headers.add('X-XSS-Protection', '1; mode=block') response.headers.add('X-XSS-Protection', '1; mode=block')
response.headers.add('Content-Security-Policy',
"default-src 'self' 'unsafe-inline'")
return response return response

1
tests/app/main/views/test_headers.py
View File

@@ -6,3 +6,4 @@ def test_owasp_useful_headers_set(notifications_admin):
assert response.headers['X-Frame-Options'] == 'deny' assert response.headers['X-Frame-Options'] == 'deny'
assert response.headers['X-Content-Type-Options'] == 'nosniff' assert response.headers['X-Content-Type-Options'] == 'nosniff'
assert response.headers['X-XSS-Protection'] == '1; mode=block' assert response.headers['X-XSS-Protection'] == '1; mode=block'
assert response.headers['Content-Security-Policy'] == "default-src 'self' 'unsafe-inline'" # noqa