(owner: str, scope: str, target, pin: str)
| 1818 | resp.headers.setdefault("Strict-Transport-Security", "max-age=31536000; includeSubDomains") |
| 1819 | except Exception: |
| 1820 | pass |
| 1821 | |
| 1822 | # Avoid caching authenticated or sensitive pages in browsers / shared devices. |
| 1823 | try: |
| 1824 | sensitive_endpoints = { |
| 1825 | "chat_with", "group_chat", "discussion", "profile", "settings_security", |
| 1826 | "settings_appearance_page", "admin_panel", "admin_logs", "profiler", "news", |
| 1827 | "face_detector", "reports", "files", "locations_page" |
| 1828 | } |
| 1829 | if is_logged_in() or (request.endpoint in sensitive_endpoints): |
| 1830 | resp.headers["Cache-Control"] = "no-store, no-cache, must-revalidate, private, max-age=0" |
| 1831 | resp.headers["Pragma"] = "no-cache" |
| 1832 | resp.headers["Expires"] = "0" |
| 1833 | except Exception: |
| 1834 | pass |
| 1835 | |
| 1836 | # Mark cookies Secure when served over HTTPS (keeps local HTTP working). |
| 1837 | try: |
| 1838 | if request.is_secure: |
| 1839 | cookies = resp.headers.getlist("Set-Cookie") |
| 1840 | if cookies: |
| 1841 | resp.headers.pop("Set-Cookie", None) |
| 1842 | for c in cookies: |
| 1843 | if "; Secure" not in c and "; secure" not in c: |
| 1844 | c = c + "; Secure" |
| 1845 | resp.headers.add("Set-Cookie", c) |
| 1846 | except Exception: |
no test coverage detected