(tooling-trusted-releases) 01/04: #1700 - audit guidance for additional headers

[ar...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

alitheg pushed a commit to branch arm
in repository https://gitbox.apache.org/repos/asf/tooling-trusted-releases.git

commit 9d9de4b331557282b37c6a540bf1f6c642aa96f6
Author: Alastair McFarlane <ar...@apache.org>
AuthorDate: Mon Oct 5 14:16:59 2026 +0100

    #1700 - audit guidance for additional headers
---
 atr/server.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/atr/server.py b/atr/server.py
index d6c39769..05648d2f 100644
--- a/atr/server.py
+++ b/atr/server.py
@@ -642,6 +642,8 @@ def _app_setup_security_headers(app: base.QuartApp) -> None:
             response.headers["Cache-Control"] = "no-store"
         response.headers["Content-Security-Policy"] = csp_header
         response.headers["Permissions-Policy"] = permissions_policy
+        # audit_guidance we set Cross-Origin-Opener-Policy: same-origin in our frontend proxy
+        # audit_guidance we set Cross-Origin-Resource-Policy: same-origin in our frontend proxy
         # audit_guidance we set Referrer-Policy: same-origin in our frontend proxy
         # audit_guidance we set X-Content-Type-Options: nosniff in our frontend proxy
         # audit_guidance we set X-Frame-Options: DENY in our frontend proxy


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org