| Server | nginx |
| Content-Type | text/html; charset=utf-8 |
| Vary | Accept-Encoding |
| Status | 200 OK |
| X-Frame-Options | SAMEORIGIN |
| Cache-Control | no-store, max-age=0, private, must-revalidate |
| ETag | W/"7f34e18315551a356eb0b986286e40e5" |
| Referrer-Policy | same-origin |
| X-UA-Compatible | IE=Edge,chrome=1 |
| Content-Security-Policy | default-src 'self' https: blob:; child-src *; connect-src 'self' https: wss: *.amap.com *.inspectlet.com; font-src 'self' data: *.muscache.com fonts.gstatic.com use.typekit.net; img-src 'self' https: data: *.inspectlet.com; media-src 'self' https:; script-src 'self' 'unsafe-eval' a0.muscache.com cdn.siftscience.com ss.musthird.com t1.musthird.com bat.bing.com connect.facebook.net www.google-analytics.com www.googleadservices.com tpc.googlesyndication.com www.googletagmanager.com maps.googleapis.com ajax.googleapis.com *.g.doubleclick.net www.google.com www.gstatic.com app.link cdn.branch.io bam.nr-data.net js-agent.newrelic.com sslwidget.criteo.com static.criteo.net dis.criteo.com widget.us.criteo.com *.gbc.criteo.net ethn.io blob: webapi.amap.com restapi.amap.com *.inspectlet.com https: 'sha256-Gn3R3CfqodkNUs+C4gXoCllPFSnBVuhJSWkVuIlhYzc=' 'unsafe-inline' 'sha256-rfTud2kTm0UjtJ6PqxcrkglfrUD4H8WCcS9mCs6PJ5s='; style-src 'self' https: 'unsafe-inline'; report-uri /tracking/csp?action=tell_a_friend&controller=referrals&report_only=false&req_uuid=3ea92876-537c-41b8-b3b9-a2db63027ef5&version=b6ec21fc1ef65e04aa96632e287a741d2086a502 |
| Content-Security-Policy-Report-Only | default-src blob: *; connect-src blob: *; font-src 'self' data: *.muscache.com fonts.gstatic.com use.typekit.net; img-src 'self' https: data: *.inspectlet.com; script-src 'self' 'unsafe-eval' webpack.localhost.airbnb.com jira.airbnb.biz googleads.g.doubleclick.net cdn.siftscience.com ss.musthird.com t1.musthird.com bat.bing.com connect.facebook.net www.google-analytics.com www.googleadservices.com tpc.googlesyndication.com www.googletagmanager.com maps.googleapis.com ajax.googleapis.com app.link cdn.branch.io bam.nr-data.net js-agent.newrelic.com sslwidget.criteo.com static.criteo.net dis.criteo.com widget.us.criteo.com ethn.io blob: webapi.amap.com restapi.amap.com *.inspectlet.com cdn.ampproject.org/v0.js cdn.ampproject.org/v0/ a.alipayobjects.com gw.alipayobjects.com static.agrant.com.cn t.agrantsem.com ditu.google.com *.muscache.cn *.muscache.com ss.musthird.cn www.google.com www.gstatic.com b92.yahoo.co.jp mc.yandex.ru wcs.naver.net a.cdn.intentmedia.net 'sha256-Gn3R3CfqodkNUs+C4gXoCllPFSnBVuhJSWkVuIlhYzc=' 'unsafe-inline' 'sha256-rfTud2kTm0UjtJ6PqxcrkglfrUD4H8WCcS9mCs6PJ5s='; style-src * blob: 'unsafe-inline'; report-uri /tracking/csp?action=tell_a_friend&controller=referrals&report_only=true&req_uuid=3ea92876-537c-41b8-b3b9-a2db63027ef5&version=b6ec21fc1ef65e04aa96632e287a741d2086a502 |
| X-Content-Type-Options | nosniff |
| X-XSS-Protection | 1; mode=block |
| Content-Encoding | gzip |
| Strict-Transport-Security | max-age=10886400; includeSubdomains |
| Transfer-Encoding | chunked |
| Connection | keep-alive, Transfer-Encoding |