headers.py

from flask import Flask

APP = Flask(__name__)

@APP.after_request
def add_header(response):
    url = 'http://localhost'
    response.headers['Server'] = 'ESF'
    response.headers['X-XSS-Protection'] = "1; mode=block"
    response.headers['Strict-Transport-Security'] = 'max-age=15724800; includeSubdomains'
    response.headers['X-Frame-Options'] = "DENY"
    response.headers['X-Permitted-Cross-Domain-Policies'] = "none"
    response.headers['X-Content-Type-Options'] = "nosniff"
    response.headers['Content-Security-Policy'] = "script-src 'unsafe-inline' %s ; font-src 'self' https://fonts.gstatic.com https://fonts.googleapis.com; frame-ancestors 'none';" % url
    response.headers['Access-Control-Expose-Headers'] = "Content-Length, Set-Cookie"
    response.headers['Access-Control-Allow-Credentials'] = "true"
    response.headers['Access-Control-Allow-Origin'] = url
    response.headers['Access-Control-Allow-Headers'] = "*"
    response.headers['Access-Control-Allow-Methods'] = "GET, POST, PUT, PATCH, DELETE"
    response.headers['Access-Control-Request-Headers'] = "*"
    response.headers['Access-Control-Max-Age'] = '600'
    response.headers['Referrer-Policy'] = 'same-origin'
    return response