// special *.sjs specifically customized for the needs of
// Bug 1139297 and Bug 663570
const PRE_HEAD =
"" +
"" +
"";
const POST_HEAD =
"" +
"Bug 1139297 - Implement CSP upgrade-insecure-requests directive" +
"" +
"" +
"
" +
"" +
"";
const PRE_CSP = "upgrade-insecure-requests; default-src https:; ";
const CSP_REFERRER_ORIGIN = "referrer origin";
const CSP_REFEFFER_NO_REFERRER = "referrer no-referrer";
function handleRequest(request, response)
{
// avoid confusing cache behaviors
response.setHeader("Cache-Control", "no-cache", false);
var queryString = request.queryString;
if (queryString === "test1") {
response.setHeader("Content-Security-Policy", PRE_CSP + CSP_REFERRER_ORIGIN, false);
response.write(PRE_HEAD + POST_HEAD);
return;
}
if (queryString === "test2") {
response.setHeader("Content-Security-Policy", PRE_CSP + CSP_REFEFFER_NO_REFERRER, false);
response.write(PRE_HEAD + POST_HEAD);
return;
}
if (queryString === "test3") {
var metacsp = "";
response.write(PRE_HEAD + metacsp + POST_HEAD);
return;
}
if (queryString === "test4") {
var metacsp = "";
response.write(PRE_HEAD + metacsp + POST_HEAD);
return;
}
// we should never get here, but just in case return
// something unexpected
response.write("do'h");
}