fix: 替换过时的 X-XSS-Protection 为 Content-Security-Policy

2026-07-10 15:27:27 +08:00
parent 276a1401f4
commit 29bdfcfb18
3 changed files with 9 additions and 6 deletions
@@ -79,7 +79,7 @@ async def security_headers_middleware(request: Request, call_next):
    response = await call_next(request)
    response.headers["X-Content-Type-Options"] = "nosniff"
    response.headers["X-Frame-Options"] = "DENY"
-    response.headers["X-XSS-Protection"] = "1; mode=block"
+    response.headers["Content-Security-Policy"] = "default-src 'self'"
    response.headers["Referrer-Policy"] = "no-referrer"
    return response