@app.after_request
def add_security_headers(response):
    response.headers['X-Frame-Options'] = 'DENY'
    response.headers['X-Content-Type-Options'] = 'nosniff'
    response.headers['Strict-Transport-Security'] = app.config.get('STRICT_TRANSPORT_SECURITY', 'max-age=31536000;')
    if re.match('^/ui/', request.path):
        response.headers['X-Frame-Options'] = 'SAMEORIGIN'
    else:
        response.headers['Content-Security-Policy'] = app.config.get('CONTENT_SECURITY_POLICY', "default-src 'none'; frame-ancestors 'none'")
    return response
@app.after_request
def add_security_headers(response):
    response.headers['X-Frame-Options'] = 'DENY'
    response.headers['X-Content-Type-Options'] = 'nosniff'
    response.headers['Strict-Transport-Security'] = app.config.get('STRICT_TRANSPORT_SECURITY', 'max-age=31536000;')
    if re.match('^/ui/', request.path):
        response.headers['X-Frame-Options'] = 'SAMEORIGIN'
    else:
        response.headers['Content-Security-Policy'] = app.config.get('CONTENT_SECURITY_POLICY', "default-src 'none'; frame-ancestors 'none'")
    return response