(owner: str, scope: str, target, pin: str)
| 1796 | csp_value = ( |
| 1797 | "default-src 'self'; " |
| 1798 | "base-uri 'self'; " |
| 1799 | "form-action 'self'; " |
| 1800 | "frame-ancestors 'none'; " |
| 1801 | "object-src 'none'; " |
| 1802 | "img-src 'self' data: blob: https:; " |
| 1803 | "media-src 'self' blob: data: https:; " |
| 1804 | "font-src 'self' data: https:; " |
| 1805 | "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; " |
| 1806 | "script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://cdn.jsdelivr.net; " |
| 1807 | "worker-src 'self' blob: https://cdn.jsdelivr.net; " |
| 1808 | "child-src 'self' blob: https://cdn.jsdelivr.net; " |
| 1809 | "connect-src 'self' https: blob: data: wss:; " |
| 1810 | ) |
| 1811 | except Exception: |
| 1812 | pass |
| 1813 | resp.headers.setdefault("Content-Security-Policy", csp_value) |
| 1814 | |
| 1815 | # Only set HSTS when actually served over HTTPS (safe for Cloudflared/Tor HTTPS frontends). |
| 1816 | try: |
| 1817 | if request.is_secure: |
| 1818 | resp.headers.setdefault("Strict-Transport-Security", "max-age=31536000; includeSubDomains") |
| 1819 | except Exception: |
| 1820 | pass |
no test coverage detected