HTTP/2 200 
content-type: application/pdf;charset=UTF-8
date: Thu, 01 Oct 2026 20:26:02 GMT
last-modified: Wed, 12 Mar 2025 13:01:36 GMT
referrer-policy: same-origin
x-ua-compatible: IE=edge
x-content-security-policy-report-only: default-src 'self'; connect-src 'self' analytics.init.de; base-uri 'self'; style-src 'self' 'unsafe-inline' *.openlayers.org openlayers.org *.openstreetmap.org *.twitter.com *.instagram.com *.europa.eu *.3qsdn.com *.twimg.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleapis.com *.google.com *.gstatic.com *.openlayers.org openlayers.org *.openstreetmap.org *.init.de *.twitter.com *.instagram.com *.europa.eu *.3qsdn.com *.twimg.com *.flockler.com *.bundesfinanzministerium.de; object-src 'self'; media-src 'self' *.youtube.com *.bundesfinanzministerium.de; child-src *.google.com *.gstatic.com *.youtube.com *.init.de *.twitter.com *.instagram.com *.europa.eu *.3qsdn.com *.twimg.com; img-src 'self' data: *.google.com *.gstatic.com *.youtube.com *.openlayers.org openlayers.org *.openstreetmap.org *.init.de *.twitter.com *.instagram.com *.europa.eu *.3qsdn.com *.twimg.com *.bundesfinanzministerium.de; frame-ancestors 'self'; report-uri /site/servlet/csp-report;
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-xss-protection: 1;mode=block
content-security-policy-report-only: default-src 'self'; connect-src 'self' analytics.init.de; base-uri 'self'; style-src 'self' 'unsafe-inline' *.openlayers.org openlayers.org *.openstreetmap.org *.twitter.com *.instagram.com *.europa.eu *.3qsdn.com *.twimg.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleapis.com *.google.com *.gstatic.com *.openlayers.org openlayers.org *.init.de *.openstreetmap.org *.twitter.com *.instagram.com *.europa.eu *.3qsdn.com *.twimg.com *.flockler.com *.bundesfinanzministerium.de; object-src 'self'; media-src 'self' *.youtube.com *.bundesfinanzministerium.de; child-src *.google.com *.gstatic.com *.youtube.com *.init.de *.twitter.com *.instagram.com *.europa.eu *.3qsdn.com *.twimg.com; img-src 'self' data: *.google.com *.gstatic.com *.youtube.com *.openlayers.org openlayers.org *.openstreetmap.org *.init.de *.twitter.com *.instagram.com *.europa.eu *.3qsdn.com *.twimg.com *.bundesfinanzministerium.de; frame-ancestors 'self'; report-uri /site/servlet/csp-report;
content-language: de-DE
vary: Accept-Encoding
cache-control: public
age: 0
etag: W/"cb595601a1290c8e82ebe9a8891b2455-gzip"
accept-ranges: bytes
strict-transport-security: max-age=31536000