vbatts/microblog.pub
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Tweak design and try to prevent CSRF issues

Browse source
This commit is contained in:
Thomas Sileo 2022-07-08 09:01:25 +02:00
parent 7bb417759e
commit 68c13b275d
4 changed files with 32 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
app/main.py
View file

@ -122,6 +122,17 @@ async def add_security_headers(request: Request, call_next):
response.headers["x-content-type-options"] = "nosniff"
response.headers["x-xss-protection"] = "1; mode=block"
response.headers["x-frame-options"] = "SAMEORIGIN"
if request.url.path.startswith("/admin/login") or (
is_current_user_admin(request)
and not (
request.url.path.startswith("/attachments")
or request.url.path.startswith("/proxy")
or request.url.path.startswith("/static")
)
):
# Prevent caching (to prevent caching CSRF tokens)
response.headers["Cache-Control"] = "private"
# TODO(ts): disallow inline CSS?
if DEBUG:
return response