darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-24 00:07:02 -04:00
Code Issues Packages Projects Releases Wiki Activity

Add 'self' to 'frame-src' header

Browse Source 
Allows iframes to contain pages from the same
domain as the parent page.
This commit is contained in:
Tom Byers
2018-08-01 14:28:45 +01:00
parent 6a06d4d714
commit 7b955ffad2
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/__init__.py
View File

@@ -514,7 +514,7 @@ def useful_headers_after_request(response):
"object-src 'self';" "object-src 'self';"
"font-src 'self' data:;" "font-src 'self' data:;"
"img-src 'self' *.google-analytics.com *.notifications.service.gov.uk {} data:;" "img-src 'self' *.google-analytics.com *.notifications.service.gov.uk {} data:;"
"frame-src www.youtube.com;".format(get_cdn_domain()) "frame-src 'self' www.youtube.com;".format(get_cdn_domain())
)) ))
if 'Cache-Control' in response.headers: if 'Cache-Control' in response.headers:
del response.headers['Cache-Control'] del response.headers['Cache-Control']