hashbang · lrvick · Oct 11, 2016 · Oct 11, 2016 · Feb 26, 2017 · Feb 26, 2017
diff --git a/server.py b/server.py
@@ -125,18 +125,19 @@ def get(self, out_format='json'):
 
 
 def security_headers(response, secure=False):
-    csp = "default-src 'none'; "                            \
-          "style-src https://fonts.googleapis.com 'self'; " \
-          "font-src https://fonts.gstatic.com; "            \
-          "img-src data:; script-src 'self'; "              \
-          "sandbox allow-same-origin allow-scripts; "       \
+    csp = "default-src 'none'; "                                   \
+          "style-src https://fonts.googleapis.com 'self'; "        \
+          "font-src https://fonts.gstatic.com; "                   \
+          "img-src data:; script-src 'self'; connect-src 'self'; " \
+          "sandbox allow-same-origin allow-scripts; "              \
           "frame-ancestors 'none'"
 
-    response.headers['Content-Security-Policy'] = csp
-    response.headers['Referrer-Policy']         = 'no-referrer'
-    response.headers['X-Content-Type-Options']  = 'nosniff'
-    response.headers['X-Frame-Options']         = 'DENY'
-    response.headers['X-XSS-Protection']        = '1; mode=block'
+    response.headers['Content-Security-Policy']     = csp
+    response.headers['Referrer-Policy']             = 'no-referrer'
+    response.headers['X-Content-Type-Options']      = 'nosniff'
+    response.headers['X-Frame-Options']             = 'DENY'
+    response.headers['X-XSS-Protection']            = '1; mode=block'
+    response.headers['Access-Control-Allow-Origin'] = 'https://hashbang.sh/'
 
     if secure:
         response.headers['Strict-Transport-Security'] = 'max-age=31536000'

diff --git a/src/hashbang.html b/src/hashbang.html
@@ -64,11 +64,12 @@
     <meta name="MobileOptimized" content="320"/>
     <link href="https://fonts.googleapis.com/css?family=Montserrat" rel="stylesheet" type="text/css">
     <link href="/assets/local.css" rel="stylesheet" type="text/css">
+    <link type="image/png" rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQAQAAAAA3iMLMAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAAAmJLR0QAAd2KE6QAAAAYSURBVAjXY2CAAck+EKp/B0II9gMoGwYA4+MJkeae/NUAAAAldEVYdGRhdGU6Y3JlYXRlADIwMTQtMDUtMTdUMTM6MzI6MTMtMDQ6MDB7pieOAAAAJXRFWHRkYXRlOm1vZGlmeQAyMDE0LTA1LTE3VDEzOjMxOjQ4LTA0OjAwqyt+rwAAAABJRU5ErkJggg==">
   </head>
   <body>
-    <script src="/assets/icon.js"></script>
+    <script src="/assets/scripts.js"></script>
     <h1>#!</h1>
-    <a href="view-source:https://hashbang.sh">
+    <a id="view-source" href="view-source:https://hashbang.sh">
       <code>sh <(curl hashbang.sh | gpg)</code>
     </a>
   </body>

diff --git a/src/icon.js b/src/icon.js
diff --git a/src/local.css b/src/local.css
@@ -1,4 +1,4 @@
- * {
+body {
   text-indent:-9999px;
   -webkit-touch-callout: none;
   -webkit-user-select: none;
@@ -48,3 +48,17 @@ code {
   text-align:center;
   font-size:20px;
 }
+
+#source {
+  display:block;
+  background:black;
+  position:absolute
+  top:0px;
+  left:0px;
+  right:0px;
+  bottom:0px;
+  color:white;
+  font-family: monospace;
+  white-space: pre;
+  overflow:scroll;
+}
diff --git a/src/scripts.js b/src/scripts.js
@@ -0,0 +1,20 @@
+window.onload = function(){
+    console.log("loaded")
+    window.location="#!"
+
+    var sourceEl = document.getElementById("view-source")
+    sourceEl.removeAttribute("href");
+    sourceEl.onclick = function(){
+        var client = new XMLHttpRequest();
+        client.open('GET', 'https://hashbang.sh/');
+        client.onreadystatechange = function() {
+            console.log(client.responseText)
+            var div = document.createElement("div");
+            var sourceText = document.createTextNode(client.responseText)
+            div.appendChild(sourceText)
+            div.id = "source"
+            document.getElementsByTagName("html")[0].appendChild(div);
+        }
+        client.send();
+    }
+}