def main(request, response):
"""Send a response with the origin policy indicated by the ?policy= argument.
Won't send a policy when the browser doesn't indicate support.
The response tests whether inline script and eval are allowed, and will
send a corresponding message to the parent frame.
For easier debugging, we'll also show the results in-page.
"""
origin_policy_header = "Sec-Origin-Policy"
request_policy = request.headers.get(origin_policy_header)
response_policy = request.GET.first("policy", default="")
if request_policy and response_policy:
response.headers.set(origin_policy_header, "policy=%s" % response_policy)
response.headers.set("Vary", "sec-origin-policy")
response.headers.set("Content-Type", "text/html");
return """
Page with an Origin Policy
Reveal whether CSP with "unsafe-inline" or "unsafe-eval" is present:
- inline script allowed:
- eval allowed:
"""