don't set csp header on /api routes

This commit is contained in:
Izalia Mae 2024-03-16 06:10:58 -04:00
parent 5c210dc20f
commit ea0658e2ea

View file

@ -333,7 +333,7 @@ async def handle_response_headers(request: web.Request, handler: Callable) -> Re
resp.headers['Server'] = 'ActivityRelay'
# Still have to figure out how csp headers work
if resp.content_type == 'text/html':
if resp.content_type == 'text/html' and not request.path.startswith("/api"):
resp.headers['Content-Security-Policy'] = get_csp(request)
if not request.app['dev'] and request.path.endswith(('.css', '.js')):