scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-09-07 08:27:05 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

feat: Add support for setting Report-Only csp header

Browse source
This commit is contained in:
Trond Froding 2026-04-10 11:44:18 +02:00
parent 1dcbfd47fb
commit 2882eee1f7
No known key found for this signature in database
GPG key ID: 653AF2B9CF4D1888
1 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
backend/open_webui/utils/security_headers.py
View file

@ -28,6 +28,7 @@ def set_security_headers() -> Dict[str, str]:
- x-frame-options
- x-permitted-cross-domain-policies
- content-security-policy
- content-security-policy-report-only
- reporting-endpoints
Each environment variable is associated with a specific setter function
@ -48,6 +49,7 @@ def set_security_headers() -> Dict[str, str]:
'XFRAME_OPTIONS': set_xframe,
'XPERMITTED_CROSS_DOMAIN_POLICIES': set_xpermitted_cross_domain_policies,
'CONTENT_SECURITY_POLICY': set_content_security_policy,
'CONTENT_SECURITY_POLICY_REPORT_ONLY': set_content_security_policy_report_only,
'REPORTING_ENDPOINTS': set_reporting_endpoints,
}
@ -135,6 +137,11 @@ def set_content_security_policy(value: str):
return {'Content-Security-Policy': value}
# Set Content-Security-Policy-Report-Only response header
def set_content_security_policy_report_only(value: str):
return {'Content-Security-Policy-Report-Only': value}
# Set Reporting-Endpoints response header
def set_reporting_endpoints(value: str):
return {'Reporting-Endpoints': value}