From 426426b278641e8f01a0ad8f1d4660341e09459e Mon Sep 17 00:00:00 2001 From: "nik.n" Date: Wed, 24 Jan 2024 15:11:49 +0900 Subject: [PATCH] =?UTF-8?q?=E3=83=98=E3=83=83=E3=83=80=E3=83=BCCache-Contr?= =?UTF-8?q?ol=E3=83=BBX-Content-Type-Options=E3=83=BBStrict-Transport-Secu?= =?UTF-8?q?rity=E5=AE=9F=E8=A3=85?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ecs/jskult-webapp/src/controller/bio_api.py | 16 +++++++++++ ecs/jskult-webapp/src/controller/login.py | 16 +++++++++++ ecs/jskult-webapp/src/controller/logout.py | 7 +++++ .../src/router/session_router.py | 8 ++++++ ecs/jskult-webapp/src/templates/_header.html | 27 +++++++------------ 5 files changed, 56 insertions(+), 18 deletions(-) diff --git a/ecs/jskult-webapp/src/controller/bio_api.py b/ecs/jskult-webapp/src/controller/bio_api.py index 2f96408a..d907fd70 100644 --- a/ecs/jskult-webapp/src/controller/bio_api.py +++ b/ecs/jskult-webapp/src/controller/bio_api.py @@ -79,6 +79,14 @@ def search_bio_data( 'data': data, 'count': bio_sales_lot_count }) + + # X-Content-Type-Optionsヘッダー追加 + json_response.headers['X-Content-Type-Options'] = 'nosniff' + # Strict-Transport-Securityヘッダー追加 + json_response.headers['Strict-Transport-Security'] = 'max-age=31536000 includeSubDomains' + # Cache-Controlヘッダー追加 + json_response.headers['Cache-Control'] = 'private' + # クッキーも書き換え json_response.set_cookie( key='session', @@ -152,6 +160,14 @@ async def download_bio_data( 'status': 'ok', 'download_url': download_file_url }) + + # X-Content-Type-Optionsヘッダー追加 + json_response.headers['X-Content-Type-Options'] = 'nosniff' + # Strict-Transport-Securityヘッダー追加 + json_response.headers['Strict-Transport-Security'] = 'max-age=31536000 includeSubDomains' + # Cache-Controlヘッダー追加 + json_response.headers['Cache-Control'] = 'private' + json_response.set_cookie( key='session', value=session.session_key, diff --git a/ecs/jskult-webapp/src/controller/login.py b/ecs/jskult-webapp/src/controller/login.py index c8a5663c..3edf877d 100644 --- a/ecs/jskult-webapp/src/controller/login.py +++ b/ecs/jskult-webapp/src/controller/login.py @@ -113,6 +113,14 @@ def login( status_code=status.HTTP_303_SEE_OTHER, headers={'session_key': session_key} ) + + # X-Content-Type-Optionsヘッダー追加 + response.headers['X-Content-Type-Options'] = 'nosniff' + # Strict-Transport-Securityヘッダー追加 + response.headers['Strict-Transport-Security'] = 'max-age=31536000 includeSubDomains' + # Cache-Controlヘッダー追加 + response.headers['Cache-Control'] = 'private' + return response @@ -170,4 +178,12 @@ def sso_authorize( status_code=status.HTTP_303_SEE_OTHER, headers={'session_key': session_key} ) + + # X-Content-Type-Optionsヘッダー追加 + response.headers['X-Content-Type-Options'] = 'nosniff' + # Strict-Transport-Securityヘッダー追加 + response.headers['Strict-Transport-Security'] = 'max-age=31536000 includeSubDomains' + # Cache-Controlヘッダー追加 + response.headers['Cache-Control'] = 'private' + return response diff --git a/ecs/jskult-webapp/src/controller/logout.py b/ecs/jskult-webapp/src/controller/logout.py index 76d9ef60..c11e10d0 100644 --- a/ecs/jskult-webapp/src/controller/logout.py +++ b/ecs/jskult-webapp/src/controller/logout.py @@ -54,4 +54,11 @@ def logout_view( if session: session_service.delete_session(session) + # X-Content-Type-Optionsヘッダー追加 + template_response.headers['X-Content-Type-Options'] = 'nosniff' + # Strict-Transport-Securityヘッダー追加 + template_response.headers['Strict-Transport-Security'] = 'max-age=31536000 includeSubDomains' + # Cache-Controlヘッダー追加 + template_response.headers['Cache-Control'] = 'private' + return template_response diff --git a/ecs/jskult-webapp/src/router/session_router.py b/ecs/jskult-webapp/src/router/session_router.py index a4a28e25..4f6ffe2f 100644 --- a/ecs/jskult-webapp/src/router/session_router.py +++ b/ecs/jskult-webapp/src/router/session_router.py @@ -103,6 +103,14 @@ class AfterSetCookieSessionRoute(MeDaCaRoute): """事後処理として、セッションキーをcookieに設定するカスタムルートハンドラー""" async def post_process_route(self, request: Request, response: Response): response = await super().post_process_route(request, response) + + # X-Content-Type-Optionsヘッダー追加 + response.headers['X-Content-Type-Options'] = 'nosniff' + # Strict-Transport-Securityヘッダー追加 + response.headers['Strict-Transport-Security'] = 'max-age=31536000 includeSubDomains' + # Cache-Controlヘッダー追加 + response.headers['Cache-Control'] = 'private' + session_key = response.headers.get('session_key', None) # セッションキーがない場合はセットせずに返す if session_key is None: diff --git a/ecs/jskult-webapp/src/templates/_header.html b/ecs/jskult-webapp/src/templates/_header.html index 920d0beb..458df9fb 100644 --- a/ecs/jskult-webapp/src/templates/_header.html +++ b/ecs/jskult-webapp/src/templates/_header.html @@ -1,15 +1,9 @@ - + + - - - - - - - - - \ No newline at end of file + + + + + + + \ No newline at end of file