Source code
Revision control
Copy as Markdown
Other Tools
def main(request, response):
if request.headers.get(b"If-None-Match"):
# we are now receing the second request, we will send back a different CSP
# with the 304 response
response.status = 304
headers = [(b"Content-Type", b"text/html"),
(b"Content-Security-Policy", b"script-src 'nonce-def' 'sha256-IIB78ZS1RMMrAWpsLg/RrDbVPhI14rKm3sFOeKPYulw='"),
(b"Cache-Control", b"private, max-age=0, must-revalidate"),
(b"ETag", b"123456")]
return headers, u""
else:
headers = [(b"Content-Type", b"text/html"),
(b"Content-Security-Policy", b"script-src 'nonce-abc' 'sha256-IIB78ZS1RMMrAWpsLg/RrDbVPhI14rKm3sFOeKPYulw='"),
(b"Cache-Control", b"private, max-age=0, must-revalidate"),
(b"Etag", b"123456")]
return headers, u'''
<!DOCTYPE html>
<html>
<head>
<script>
window.addEventListener("securitypolicyviolation", function(e) {
top.postMessage(e.originalPolicy, '*');
});
</script>
<script nonce="abc">
top.postMessage('abc_executed', '*');
</script>
<script nonce="def">
top.postMessage('def_executed', '*');
</script>
</head>
</html>
'''