diff --git a/ecs/jskult-webapp/src/controller/bio_api.py b/ecs/jskult-webapp/src/controller/bio_api.py
index 2f96408a..d907fd70 100644
--- a/ecs/jskult-webapp/src/controller/bio_api.py
+++ b/ecs/jskult-webapp/src/controller/bio_api.py
@@ -79,6 +79,14 @@ def search_bio_data(
'data': data,
'count': bio_sales_lot_count
})
+
+ # X-Content-Type-Optionsヘッダー追加
+ json_response.headers['X-Content-Type-Options'] = 'nosniff'
+ # Strict-Transport-Securityヘッダー追加
+ json_response.headers['Strict-Transport-Security'] = 'max-age=31536000 includeSubDomains'
+ # Cache-Controlヘッダー追加
+ json_response.headers['Cache-Control'] = 'private'
+
# クッキーも書き換え
json_response.set_cookie(
key='session',
@@ -152,6 +160,14 @@ async def download_bio_data(
'status': 'ok',
'download_url': download_file_url
})
+
+ # X-Content-Type-Optionsヘッダー追加
+ json_response.headers['X-Content-Type-Options'] = 'nosniff'
+ # Strict-Transport-Securityヘッダー追加
+ json_response.headers['Strict-Transport-Security'] = 'max-age=31536000 includeSubDomains'
+ # Cache-Controlヘッダー追加
+ json_response.headers['Cache-Control'] = 'private'
+
json_response.set_cookie(
key='session',
value=session.session_key,
diff --git a/ecs/jskult-webapp/src/controller/login.py b/ecs/jskult-webapp/src/controller/login.py
index c8a5663c..3edf877d 100644
--- a/ecs/jskult-webapp/src/controller/login.py
+++ b/ecs/jskult-webapp/src/controller/login.py
@@ -113,6 +113,14 @@ def login(
status_code=status.HTTP_303_SEE_OTHER,
headers={'session_key': session_key}
)
+
+ # X-Content-Type-Optionsヘッダー追加
+ response.headers['X-Content-Type-Options'] = 'nosniff'
+ # Strict-Transport-Securityヘッダー追加
+ response.headers['Strict-Transport-Security'] = 'max-age=31536000 includeSubDomains'
+ # Cache-Controlヘッダー追加
+ response.headers['Cache-Control'] = 'private'
+
return response
@@ -170,4 +178,12 @@ def sso_authorize(
status_code=status.HTTP_303_SEE_OTHER,
headers={'session_key': session_key}
)
+
+ # X-Content-Type-Optionsヘッダー追加
+ response.headers['X-Content-Type-Options'] = 'nosniff'
+ # Strict-Transport-Securityヘッダー追加
+ response.headers['Strict-Transport-Security'] = 'max-age=31536000 includeSubDomains'
+ # Cache-Controlヘッダー追加
+ response.headers['Cache-Control'] = 'private'
+
return response
diff --git a/ecs/jskult-webapp/src/controller/logout.py b/ecs/jskult-webapp/src/controller/logout.py
index 76d9ef60..c11e10d0 100644
--- a/ecs/jskult-webapp/src/controller/logout.py
+++ b/ecs/jskult-webapp/src/controller/logout.py
@@ -54,4 +54,11 @@ def logout_view(
if session:
session_service.delete_session(session)
+ # X-Content-Type-Optionsヘッダー追加
+ template_response.headers['X-Content-Type-Options'] = 'nosniff'
+ # Strict-Transport-Securityヘッダー追加
+ template_response.headers['Strict-Transport-Security'] = 'max-age=31536000 includeSubDomains'
+ # Cache-Controlヘッダー追加
+ template_response.headers['Cache-Control'] = 'private'
+
return template_response
diff --git a/ecs/jskult-webapp/src/router/session_router.py b/ecs/jskult-webapp/src/router/session_router.py
index a4a28e25..4f6ffe2f 100644
--- a/ecs/jskult-webapp/src/router/session_router.py
+++ b/ecs/jskult-webapp/src/router/session_router.py
@@ -103,6 +103,14 @@ class AfterSetCookieSessionRoute(MeDaCaRoute):
"""事後処理として、セッションキーをcookieに設定するカスタムルートハンドラー"""
async def post_process_route(self, request: Request, response: Response):
response = await super().post_process_route(request, response)
+
+ # X-Content-Type-Optionsヘッダー追加
+ response.headers['X-Content-Type-Options'] = 'nosniff'
+ # Strict-Transport-Securityヘッダー追加
+ response.headers['Strict-Transport-Security'] = 'max-age=31536000 includeSubDomains'
+ # Cache-Controlヘッダー追加
+ response.headers['Cache-Control'] = 'private'
+
session_key = response.headers.get('session_key', None)
# セッションキーがない場合はセットせずに返す
if session_key is None:
diff --git a/ecs/jskult-webapp/src/templates/_header.html b/ecs/jskult-webapp/src/templates/_header.html
index 920d0beb..458df9fb 100644
--- a/ecs/jskult-webapp/src/templates/_header.html
+++ b/ecs/jskult-webapp/src/templates/_header.html
@@ -1,15 +1,9 @@
-
+
+
-
-
-
-
-
-
-
-
-
\ No newline at end of file
+
+
+
+
+
+
+
\ No newline at end of file