mirror of
https://github.com/GSA/notifications-admin.git
synced 2026-02-05 10:53:28 -05:00
0cda624657
https://www.pivotaltracker.com/story/show/115861923 Makes some changes to the content security policy, to allow the Google Analytics JS and trakcing image to be loaded, copied from @alexmuller’s excellent work on GOV.UK: https://gdstechnology.blog.gov.uk/2015/02/12/experimenting-with-content-security-policy-on-gov-uk/ https://github.com/alphagov/frontend/pull/733
10 lines
612 B
Python
10 lines
612 B
Python
|
|
def test_owasp_useful_headers_set(app_):
|
|
with app_.test_request_context():
|
|
response = app_.test_client().get('/')
|
|
assert response.status_code == 200
|
|
assert response.headers['X-Frame-Options'] == 'deny'
|
|
assert response.headers['X-Content-Type-Options'] == 'nosniff'
|
|
assert response.headers['X-XSS-Protection'] == '1; mode=block'
|
|
assert response.headers['Content-Security-Policy'] == "default-src 'self' 'unsafe-inline'; script-src 'self' *.google-analytics.com 'unsafe-inline' data:; object-src 'self'; font-src 'self' data:; img-src 'self' *.google-analytics.com data:;" # noqa
|