From #94 - Description:A Content Security Policy is not explicitly defined within the web-application.

[TiagoV-PDMFC]

From #94

CWE: 346

(NEW) Description:A Content Security Policy is not explicitly defined within the web-application.

    res.statusCode = err.statusCode;
    res.write(JSON.stringify({
        status: err.statusCode,
        error: err.message,

origin: [/fgt-api/middleware.js](https://github.com/PharmaLedger-IMI/fgt-workspace/blob/master/fgt-api/middleware.js#L8) - write line 8

[joaoluis-pdm]

Being a REST application/json server, adding a Content-Security-Policy should not be needed.

Nevertheless, if we add a Content-Security-Policy it does not seem to hurt the normal REST services functionality (according to https://stackoverflow.com/questions/37819249/what-does-it-mean-to-set-a-content-security-policy-on-response-to-a-non-html-req )
so it should be ok to set a CSP header, just to turn off the security scan vulnerability.

[joaoluis-pdm]

Released to TST on v0.10.4