diff --git a/drf_spectacular/views.py b/drf_spectacular/views.py index ac599c79..593dead6 100644 --- a/drf_spectacular/views.py +++ b/drf_spectacular/views.py @@ -146,6 +146,9 @@ def get(self, request, *args, **kwargs): 'schema_auth_names': self._dump(self._get_schema_auth_names()), }, template_name=self.template_name, + headers={ + "Cross-Origin-Opener-Policy": "unsafe-none", + } ) def _dump(self, data): diff --git a/tests/test_view.py b/tests/test_view.py index b900cbd5..9f3af9c2 100644 --- a/tests/test_view.py +++ b/tests/test_view.py @@ -150,6 +150,13 @@ def test_spectacular_ui_with_raw_settings(no_warnings): assert b'const swaggerSettings = {"deepLinking": true};\n' in response.content +@pytest.mark.urls(__name__) +def test_spectacular_ui_coop(): + response = APIClient().get('/api/v2/schema/swagger-ui/') + assert response.status_code == 200 + assert response["Cross-Origin-Opener-Policy"] == "unsafe-none" + + @pytest.mark.urls(__name__) def test_spectacular_ui_param_passthrough(no_warnings): response = APIClient().get('/api/v2/schema/swagger-ui/?foo=bar&lang=jp&version=v2')