dev/glo
3
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

Update app.py

Browse Source
This commit is contained in:
dev 2026-10-30 03:22:50 +00:00
parent 6196186b22
commit fc4f7472d1
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
app.py
View File

@ -995,6 +995,9 @@ def add_security_headers(response):
response.headers["Permissions-Policy"] = "camera=(self), microphone=(self), geolocation=()" response.headers["Permissions-Policy"] = "camera=(self), microphone=(self), geolocation=()"
response.headers["Cross-Origin-Opener-Policy"] = "same-origin" response.headers["Cross-Origin-Opener-Policy"] = "same-origin"
response.headers["Cross-Origin-Resource-Policy"] = "same-origin" response.headers["Cross-Origin-Resource-Policy"] = "same-origin"
calls_connect_origin = CALLS_BASE
calls_ws_origin = CALLS_BASE.replace("https://", "wss://").replace("http://", "ws://")
response.headers["Content-Security-Policy"] = ( response.headers["Content-Security-Policy"] = (
"default-src 'self'; " "default-src 'self'; "
"base-uri 'self'; " "base-uri 'self'; "
@ -1005,7 +1008,7 @@ def add_security_headers(response):
"media-src 'self' blob:; " "media-src 'self' blob:; "
"style-src 'self' 'unsafe-inline'; " "style-src 'self' 'unsafe-inline'; "
"script-src 'self'; " "script-src 'self'; "
"connect-src 'self';" f"connect-src 'self' {calls_connect_origin} {calls_ws_origin};"
) )
if request.path.startswith("/static/"): if request.path.startswith("/static/"):
response.headers["Cache-Control"] = "public, max-age=31536000, immutable" response.headers["Cache-Control"] = "public, max-age=31536000, immutable"