darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-09-10 01:55:41 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2397 from GSA/2391-youtube-video-not-playing

Browse Source 
2391 - Updating Cross Origin code to allow Youtube
This commit is contained in:
Beverly Nguyen
2025-03-14 12:53:59 -07:00
committed by GitHub
parent 592ea83ea2 5a1b656d7e
commit 9facde2c60
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
notifications_utils/request_helper.py
View File

@@ -75,11 +75,13 @@ class ResponseHeaderMiddleware(object):
if SPAN_ID_HEADER.lower() not in lower_existing_header_names: if SPAN_ID_HEADER.lower() not in lower_existing_header_names:
headers.append((SPAN_ID_HEADER, str(req.span_id))) headers.append((SPAN_ID_HEADER, str(req.span_id)))
# Some dynamic scan findings # Set COOP once (needed for security)
headers.append(("Cross-Origin-Opener-Policy", "same-origin")) if "cross-origin-opener-policy" not in lower_existing_header_names:
headers.append(("Cross-Origin-Embedder-Policy", "require-corp")) headers.append(("Cross-Origin-Opener-Policy", "same-origin"))
headers.append(("Cross-Origin-Resource-Policy", "same-origin"))
headers.append(("Cross-Origin-Opener-Policy", "same-origin")) # Ensure `Cross-Origin-Resource-Policy: cross-origin` is set
if "cross-origin-resource-policy" not in lower_existing_header_names:
headers.append(("Cross-Origin-Resource-Policy", "cross-origin"))
# svg content type should not contain charset # svg content type should not contain charset
found_svg = False found_svg = False