maverick/docbrown
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[deploy] Add initial content security policy into codebase (to avoid reliance on edge configuration) (#10144)

Browse source 
* Initial secure header functionality

* Add unsafe-inline to csp

* Secure cookies

* Add connect-src

* Only run secure header config in prod (for now)

* Change prod check to within default

* Change from secure_headers to rails config

* Wrap behind production check
This commit is contained in:
Ben Halpern 2020-09-01 20:32:13 -04:00 • committed by GitHub
parent b60c6c687c
commit 0efcc7f47f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 9 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
config/initializers/content_security_policy.rb
View file

@ -5,13 +5,15 @@
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
Rails.application.config.content_security_policy do |policy|
# policy.default_src :self, :https
# policy.font_src :self, :https, :data
# policy.img_src :self, :https, :data
# policy.object_src :none
# policy.script_src :self, :https
# policy.style_src :self, :https
if Rails.env.production?
policy.default_src :self, :https
policy.font_src :self, :https, :data
policy.img_src :self, :https, :data
policy.object_src :none
policy.script_src :self, :https, :unsafe_inline
policy.style_src :self, :https, :unsafe_inline
policy.connect_src :self, :https, :unsafe_inline, "*.pusher.com"
end
# # Specify URI for violation reports
# # policy.report_uri "/csp-violation-report-endpoint"