@@ -74,11 +74,15 @@ async def security(request, call_next):
|
||||
if settings().api_key and not authenticated(request.headers.get('x-api-key')):
|
||||
return JSONResponse({'success': False, 'error': {'code': 'unauthorized', 'message': 'Provide a valid X-API-Key header'}}, 401)
|
||||
response = await call_next(request)
|
||||
is_viewer = request.url.path.startswith('/view/')
|
||||
frame_ancestors = "'self' https://git.sadentel.net" if is_viewer else "'none'"
|
||||
response.headers.update({
|
||||
'X-Content-Type-Options': 'nosniff', 'Referrer-Policy': 'no-referrer',
|
||||
'Content-Security-Policy': "default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'self' data:; font-src 'self'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'",
|
||||
'Content-Security-Policy': f"default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'self' data:; font-src 'self'; base-uri 'none'; frame-ancestors {frame_ancestors}; form-action 'self'",
|
||||
'Cache-Control': 'no-store', 'Permissions-Policy': 'camera=(), microphone=(), geolocation=()',
|
||||
})
|
||||
if is_viewer and 'X-Frame-Options' in response.headers:
|
||||
del response.headers['X-Frame-Options']
|
||||
return response
|
||||
|
||||
# Register after security so CORS also decorates its early authentication errors.
|
||||
|
||||
مرجع در شماره جدید
مسدود کردن کاربر