From f246a66810fa4995d9494da3599c0fb297fb0213 Mon Sep 17 00:00:00 2001
From: Timothy Jaeryang Baek <tim@openwebui.com>
Date: Mon, 20 Apr 2026 09:10:48 +0900
Subject: [PATCH] refac

---
 backend/open_webui/utils/security_headers.py | 40 ++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/backend/open_webui/utils/security_headers.py b/backend/open_webui/utils/security_headers.py
index 33956688a1..ecc3b6eb30 100644
--- a/backend/open_webui/utils/security_headers.py
+++ b/backend/open_webui/utils/security_headers.py
@@ -28,6 +28,10 @@ def set_security_headers() -> Dict[str, str]:
     - x-frame-options
     - x-permitted-cross-domain-policies
     - content-security-policy
+    - content-security-policy-report-only
+    - cross-origin-embedder-policy
+    - cross-origin-opener-policy
+    - cross-origin-resource-policy
     - reporting-endpoints
 
     Each environment variable is associated with a specific setter function
@@ -48,6 +52,10 @@ def set_security_headers() -> Dict[str, str]:
         'XFRAME_OPTIONS': set_xframe,
         'XPERMITTED_CROSS_DOMAIN_POLICIES': set_xpermitted_cross_domain_policies,
         'CONTENT_SECURITY_POLICY': set_content_security_policy,
+        'CONTENT_SECURITY_POLICY_REPORT_ONLY': set_content_security_policy_report_only,
+        'CROSS_ORIGIN_EMBEDDER_POLICY': set_cross_origin_embedder_policy,
+        'CROSS_ORIGIN_OPENER_POLICY': set_cross_origin_opener_policy,
+        'CROSS_ORIGIN_RESOURCE_POLICY': set_cross_origin_resource_policy,
         'REPORTING_ENDPOINTS': set_reporting_endpoints,
     }
 
@@ -135,6 +143,38 @@ def set_content_security_policy(value: str):
     return {'Content-Security-Policy': value}
 
 
+# Set Content-Security-Policy-Report-Only response header
+def set_content_security_policy_report_only(value: str):
+    return {'Content-Security-Policy-Report-Only': value}
+
+
+# Set Cross-Origin-Embedder-Policy response header
+def set_cross_origin_embedder_policy(value: str):
+    pattern = r'^(unsafe-none|require-corp|credentialless)$'
+    match = re.match(pattern, value, re.IGNORECASE)
+    if not match:
+        value = 'require-corp'
+    return {'Cross-Origin-Embedder-Policy': value}
+
+
+# Set Cross-Origin-Opener-Policy response header
+def set_cross_origin_opener_policy(value: str):
+    pattern = r'^(unsafe-none|same-origin-allow-popups|same-origin)$'
+    match = re.match(pattern, value, re.IGNORECASE)
+    if not match:
+        value = 'same-origin'
+    return {'Cross-Origin-Opener-Policy': value}
+
+
+# Set Cross-Origin-Resource-Policy response header
+def set_cross_origin_resource_policy(value: str):
+    pattern = r'^(same-site|same-origin|cross-origin)$'
+    match = re.match(pattern, value, re.IGNORECASE)
+    if not match:
+        value = 'same-origin'
+    return {'Cross-Origin-Resource-Policy': value}
+
+
 # Set Reporting-Endpoints response header
 def set_reporting_endpoints(value: str):
     return {'Reporting-Endpoints': value}