render_template返回字符串，而不是响应.从视图返回的字符串由Flask自动包装在响应中，这就是为什么您可能会感到困惑的原因.使用呈现的模板构造响应.

render_template returns a string, not a response. A string returned from a view is automatically wrapped in a response by Flask, which is why you may be confused. Construct the response with the rendered template.

from flask import make_response
r = make_response(render_template('index.html'))
r.headers.set('Content-Security-Policy', "default-src 'self'")
return r