wikimedia / restbase / 958

84%

Pull #228

travis-ci

Add security headers in non-JSON responses

In modern browsers these headers help to avoid some of the most common
client-side security issues even if we missed something in our HTML and SVG
sanitization code.

I left out X-Frame-Options for now until we have checked with the VE team that
this will be compatible with their HTML parsing technique, which at least at
some point made use of iframes.

Bug: https://phabricator.wikimedia.org/T95443

11 of 11 new or added lines in 1 file covered. (100.0%)

835 of 962 relevant lines covered (86.8%)

144.36 hits per line