Add CSP for HTML5 responses

services/api-server/tests/test_api.py

@@ -57,6 +57,15 @@ def assert_html5_response_contract(response, *markers: str, full_page: bool = Fa
     assert "text/html" in response.headers["content-type"]
     assert response.headers["cache-control"] == "no-cache, no-transform"
     assert response.headers["x-content-type-options"] == "nosniff"
+    assert response.headers["content-security-policy"] == (
+        "default-src 'self'; "
+        "script-src 'self'; "
+        "style-src 'self'; "
+        "connect-src 'self'; "
+        "img-src 'self' data:; "
+        "base-uri 'self'; "
+        "form-action 'self'"
+    )
     assert_html5_contract(response.text, *markers, full_page=full_page)