diff --git a/ecs/jskult-webapp/src/controller/bio_api.py b/ecs/jskult-webapp/src/controller/bio_api.py
index d907fd70..bbb06b69 100644
--- a/ecs/jskult-webapp/src/controller/bio_api.py
+++ b/ecs/jskult-webapp/src/controller/bio_api.py
@@ -79,7 +79,9 @@ def search_bio_data(
'data': data,
'count': bio_sales_lot_count
})
-
+
+ # X-Frame-Optionsヘッダー追加
+ json_response.headers['X-Frame-Options'] = 'DENY'
# X-Content-Type-Optionsヘッダー追加
json_response.headers['X-Content-Type-Options'] = 'nosniff'
# Strict-Transport-Securityヘッダー追加
@@ -161,6 +163,8 @@ async def download_bio_data(
'download_url': download_file_url
})
+ # X-Frame-Optionsヘッダー追加
+ json_response.headers['X-Frame-Options'] = 'DENY'
# X-Content-Type-Optionsヘッダー追加
json_response.headers['X-Content-Type-Options'] = 'nosniff'
# Strict-Transport-Securityヘッダー追加
diff --git a/ecs/jskult-webapp/src/controller/login.py b/ecs/jskult-webapp/src/controller/login.py
index 3edf877d..bcc48fe1 100644
--- a/ecs/jskult-webapp/src/controller/login.py
+++ b/ecs/jskult-webapp/src/controller/login.py
@@ -114,6 +114,8 @@ def login(
headers={'session_key': session_key}
)
+ # X-Frame-Optionsヘッダー追加
+ response.headers['X-Frame-Options'] = 'DENY'
# X-Content-Type-Optionsヘッダー追加
response.headers['X-Content-Type-Options'] = 'nosniff'
# Strict-Transport-Securityヘッダー追加
@@ -179,6 +181,8 @@ def sso_authorize(
headers={'session_key': session_key}
)
+ # X-Frame-Optionsヘッダー追加
+ response.headers['X-Frame-Options'] = 'DENY'
# X-Content-Type-Optionsヘッダー追加
response.headers['X-Content-Type-Options'] = 'nosniff'
# Strict-Transport-Securityヘッダー追加
diff --git a/ecs/jskult-webapp/src/controller/logout.py b/ecs/jskult-webapp/src/controller/logout.py
index c11e10d0..99ee8813 100644
--- a/ecs/jskult-webapp/src/controller/logout.py
+++ b/ecs/jskult-webapp/src/controller/logout.py
@@ -54,6 +54,8 @@ def logout_view(
if session:
session_service.delete_session(session)
+ # X-Frame-Optionsヘッダー追加
+ template_response.headers['X-Frame-Options'] = 'DENY'
# X-Content-Type-Optionsヘッダー追加
template_response.headers['X-Content-Type-Options'] = 'nosniff'
# Strict-Transport-Securityヘッダー追加
diff --git a/ecs/jskult-webapp/src/router/session_router.py b/ecs/jskult-webapp/src/router/session_router.py
index 4f6ffe2f..9672d23b 100644
--- a/ecs/jskult-webapp/src/router/session_router.py
+++ b/ecs/jskult-webapp/src/router/session_router.py
@@ -104,6 +104,8 @@ class AfterSetCookieSessionRoute(MeDaCaRoute):
async def post_process_route(self, request: Request, response: Response):
response = await super().post_process_route(request, response)
+ # X-Frame-Optionsヘッダー追加
+ response.headers['X-Frame-Options'] = 'DENY'
# X-Content-Type-Optionsヘッダー追加
response.headers['X-Content-Type-Options'] = 'nosniff'
# Strict-Transport-Securityヘッダー追加
diff --git a/ecs/jskult-webapp/src/templates/_header.html b/ecs/jskult-webapp/src/templates/_header.html
index 458df9fb..db30bfb4 100644
--- a/ecs/jskult-webapp/src/templates/_header.html
+++ b/ecs/jskult-webapp/src/templates/_header.html
@@ -3,21 +3,9 @@
-
-
-
-
-
-
-
-
{{subtitle}}
-
-
+
+