renardeinside / schorle Goto Github PK

• schorle/src/python/schorle/app.py

  Lines 31 to 36 in 93801fd

  	def assets(file_name: str) -> PlainTextResponse:
  	_bundle = pkgutil.get_data("schorle", f"assets/{file_name}")
  	if _bundle:
  	return PlainTextResponse(_bundle.decode("utf-8"), status_code=200)
  	else:
  	return PlainTextResponse(f"File not found: {file_name}", status_code=404)

  
  When responding back with bundle.js or other assets, maybe guess the mime type:

import mimetypes
print(mimetypes.MimeTypes().guess_type('my_file.txt')[0])

When proxy is configured to add headers X-Content-Type-Options set to nosniff, browsers enforce mime types preventing the bundle.js from being executed which prevents the proper csrf token being sent to the websocket connection and this breaks the whole interactivity of the app.