14 lines
829 B
Python
Executable File
14 lines
829 B
Python
Executable File
class SecurityHeaders:
|
|
def __init__(self, get_response):
|
|
self.get_response = get_response
|
|
|
|
def __call__(self, request):
|
|
response = self.get_response(request)
|
|
response["Cache-Control"] = "no-store"
|
|
# HTTPS form posts need their same-site origin/referrer for Django's
|
|
# CSRF checks. no-referrer can produce Origin: null in browsers.
|
|
# same-origin still withholds verification URLs from external sites.
|
|
response["Referrer-Policy"] = "same-origin"
|
|
response["Content-Security-Policy"] = "default-src 'none'; style-src 'self'; img-src 'self' https://discourse.eom.dev https://gitea.eom.dev https://element.eom.dev https://mastodon.eom.dev https://peertube.eom.dev; form-action 'self'; base-uri 'none'; frame-ancestors 'none'"
|
|
return response
|