set HSTS header

snarfed · Sep 1, 2016 · 285bd06 · 285bd06
1 parent 855fc2e
commit 285bd06
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/app.py b/app.py
@@ -25,7 +25,12 @@ class FrontPageHandler(webapp2.RequestHandler):
   """Renders and serves /, ie the front page.
   """
   def get(self):
-    self.response.headers['Content-Type'] = 'text/html'
+    self.response.headers.update({
+      'Access-Control-Allow-Origin': '*',
+      'Strict-Transport-Security':
+          'max-age=16070400; includeSubDomains; preload',  # 6 months
+      'Content-Type': 'text/html',
+    })
 
     vars = dict(self.request.params)
     key = vars.get('auth_entity')