Skip to content
Snippets Groups Projects
Select Git revision
  • d9356ab8d783a0f1911b89427cc3cf1a953ded3a
  • master default
2 results

app.py

  • nimrod's avatar
    d9356ab8
    Improve security by restricting the usage of the response. · d9356ab8
    nimrod authored 
    The service replies with the message in the request. This can be used as
an attack vector as the reply is determined by the request and is coming
from a shore.co.il domain. So the following precautions are taken:

- Limit the request length to limit the usefulness of the response.
- Set the response MIME type to plain text and set the
  `X-Content-Type-Options` header to `nosniff` so the browser won't
  guess the content type.
- Set CORS headers.
    d9356ab8
    History
    Improve security by restricting the usage of the response.
    nimrod authored 
    The service replies with the message in the request. This can be used as
an attack vector as the reply is determined by the request and is coming
from a shore.co.il domain. So the following precautions are taken:

- Limit the request length to limit the usefulness of the response.
- Set the response MIME type to plain text and set the
  `X-Content-Type-Options` header to `nosniff` so the browser won't
  guess the content type.
- Set CORS headers.