tree 82eb8426e3d4f3d5e2d71ededf22e84782d6b47f
parent 489640c6e8db3d1aa999cd9429e41329cf22cd47
author Ed Tanous <ed.tanous@intel.com> 1558560496 -0700
committer Ed Tanous <ed.tanous@intel.com> 1559164609 +0000

Add security headers to websockets

websocket connections are by definition temporal, and cannot be cached.
Unfortunately, certain security scanners don't see it that way, and flag
errors on lack of CSP, XSS, and Content-Type headers when giving a
websocket upgrade response.

This commit adds the:
Strict-Transport-Security
Pragma
Cache-Control
Content-security-policy
X-XSS-Protection
X-Content-Type-Options

Headers to the response when an upgrade occurs, to make the security
scanners happy.

Tested:
Opened the main application, obseved the /subscribe api.

Signed-off-by: Ed Tanous <ed.tanous@intel.com>
Change-Id: If76dc54f6501b3eb2caf44913d254a8b32d3fd30