bug 887790: Balrog Admin UI missing security headers. r=mgerva

mozilla-releng · Mar 5, 2014 · 71b9f6e · 71b9f6e
1 parent 8a09f1a
commit 71b9f6e
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 0 deletions.
diff --git a/auslib/admin/base.py b/auslib/admin/base.py
@@ -31,6 +31,13 @@ def isa(error):
     log.debug("Request headers are: %s", request.headers)
     return error
 
+# bug 887790: add necessary security headers
+@app.after_request
+def add_security_headers(response):
+    response.headers['X-Frame-Options'] = 'DENY'
+    response.headers['X-Content-Type-Options'] = 'nosniff'
+    return response
+
 app.add_url_rule('/csrf_token', view_func=CSRFView.as_view('csrf'))
 app.add_url_rule('/users', view_func=UsersView.as_view('users'))
 app.add_url_rule('/users/<username>/permissions', view_func=PermissionsView.as_view('permissions'))

diff --git a/auslib/test/admin/views/test_index.py b/auslib/test/admin/views/test_index.py
@@ -6,6 +6,10 @@
 
 
 class TestIndexPage(ViewTest):
+    def testSecurityHeaders(self):
+        ret = self.client.get('/')
+        self.assertEquals(ret.headers['X-Frame-Options'], 'DENY')
+        self.assertEquals(ret.headers['X-Content-Type-Options'], 'nosniff')
 
     def testLandingPage(self):
         ret = self.client.get('/')