From a761017116b10eab3165416fb574ed9b99bc8833 Mon Sep 17 00:00:00 2001 From: Ozzieisaacs Date: Mon, 21 Sep 2020 19:09:02 +0200 Subject: [PATCH] Additional debug output for #1527 --- cps/web.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/cps/web.py b/cps/web.py index 341d941b..006c7f3d 100644 --- a/cps/web.py +++ b/cps/web.py @@ -129,11 +129,12 @@ if feature_support['ldap']: @app.after_request def add_security_headers(resp): # resp.headers['Content-Security-Policy']= "script-src 'self' https://www.googleapis.com https://api.douban.com https://comicvine.gamespot.com;" - resp.headers['X-Content-Type-Options'] = 'nosniff' - resp.headers['X-Frame-Options'] = 'SAMEORIGIN' - resp.headers['X-XSS-Protection'] = '1; mode=block' if "tolino" not in request.headers.get('User-Agent'): + resp.headers['X-Content-Type-Options'] = 'nosniff' + resp.headers['X-Frame-Options'] = 'SAMEORIGIN' + resp.headers['X-XSS-Protection'] = '1; mode=block' resp.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains' + log.debug(request.full_path) log.debug(request.headers) return resp