From d92f91c19e8cba4e987cc90e142502a08031bc0d Mon Sep 17 00:00:00 2001 From: luelista Date: Fri, 7 Aug 2026 12:10:10 +0200 Subject: [PATCH] Don't check CSP on JSON responses --- src/tests/control/test_views.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/tests/control/test_views.py b/src/tests/control/test_views.py index 608d865f8f..1560affe12 100644 --- a/src/tests/control/test_views.py +++ b/src/tests/control/test_views.py @@ -226,8 +226,9 @@ def test_one_view(logged_in_client, url, expected, event, item, item_category, o assert response.status_code == expected # Do not reintroduce any CSP nonces into control responses, as discussed in PR #6387 - assert 'script-src' in response['Content-Security-Policy'] - assert 'nonce-' not in response['Content-Security-Policy'] + if response['Content-Type'] != 'application/json': + assert 'script-src' in response['Content-Security-Policy'] + assert 'nonce-' not in response['Content-Security-Policy'] @pytest.mark.parametrize('url', [