burmatovan/openuds
1
0
Fork 0
forked from shaba/openuds
Code Issues Pull Requests Projects Releases Wiki Activity

added Content-Security-Policy to security

Browse Source
This commit is contained in:
Adolfo Gómez García 2021-11-30 13:31:12 +01:00
parent e18f3746b4
commit 8bebce4c6e
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
server/src/uds/core/util/middleware/security.py
View File

@ -68,4 +68,10 @@ class UDSSecurityMiddleware:
)
return HttpResponse(content='Forbbiden', status=403)
return self.get_response(request)
response = self.get_response(request)
# Legacy browser support for X-XSS-Protection
response.headers.setdefault('X-XSS-Protection', '1; mode=block')
# Add Content-Security-Policy, allowing same origin and inline scripts, images from any https source and data:
response.headers.setdefault('Content-Security-Policy', "default-src 'self' 'unsafe-inline'; img-src 'self' https: data:;")
return response