import json
def main(request, response):
    message = {}

    header = request.headers.get("Test-Header-Injection");
    message['test_header_injection'] = header if header else None

    header = request.headers.get("Sec-Required-CSP");
    message['required_csp'] = header if header else None

    second_level_iframe_code = ""
    if "include_second_level_iframe" in request.GET:
       if "second_level_iframe_csp" in request.GET and request.GET["second_level_iframe_csp"] <> "":
         second_level_iframe_code = '''<script>
            var i2 = document.createElement('iframe');
            i2.src = 'echo-required-csp.py';
            i2.csp = "{0}";
            document.body.appendChild(i2);
            </script>'''.format(request.GET["second_level_iframe_csp"])
       else:
         second_level_iframe_code = '''<script>
            var i2 = document.createElement('iframe');
            i2.src = 'echo-required-csp.py';
            document.body.appendChild(i2);
            </script>'''

    return [("Content-Type", "text/html"), ("Allow-CSP-From", "*")], '''
<!DOCTYPE html>
<html>
<head>
    <!--{2}-->
    <script>
      window.addEventListener('message', function(e) {{
        window.parent.postMessage(e.data, '*');
      }});

      window.parent.postMessage({0}, '*');
    </script>
</head>
<body>
{1}
</body>
</html>
'''.format(json.dumps(message), second_level_iframe_code, str(request.headers))