diff --git a/app.py b/app.py index ce7c0a4..567ee4c 100644 --- a/app.py +++ b/app.py @@ -74,7 +74,12 @@ limiter = Limiter(app, key_func=rate_limit_key) @app.after_request def install_security_headers(resp): - csp = "default-src 'none'; img-src 'self' https: http:; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; frame-ancestors 'none'" + csp = "default-src 'none'; img-src 'self' https: http:; style-src 'self' 'unsafe-inline'; connect-src 'self'; frame-ancestors 'none'" + if 'SENTRY_DSN' in app.config: + csp += "; script-src 'self' https://cdn.ravenjs.com/" + else: + csp += "; script-src 'self'" + if 'CSP_REPORT_URI' in app.config: csp += "; report-uri " + app.config.get('CSP_REPORT_URI') resp.headers.set('Content-Security-Policy', csp)