From 0efcc7f47f3d80501a4237dc2b0434afcf066d78 Mon Sep 17 00:00:00 2001 From: Ben Halpern Date: Tue, 1 Sep 2020 20:32:13 -0400 Subject: [PATCH] [deploy] Add initial content security policy into codebase (to avoid reliance on edge configuration) (#10144) * Initial secure header functionality * Add unsafe-inline to csp * Secure cookies * Add connect-src * Only run secure header config in prod (for now) * Change prod check to within default * Change from secure_headers to rails config * Wrap behind production check --- config/initializers/content_security_policy.rb | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb index 2b3f7e09c..06789426c 100644 --- a/config/initializers/content_security_policy.rb +++ b/config/initializers/content_security_policy.rb @@ -5,13 +5,15 @@ # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy Rails.application.config.content_security_policy do |policy| - # policy.default_src :self, :https - # policy.font_src :self, :https, :data - # policy.img_src :self, :https, :data - # policy.object_src :none - # policy.script_src :self, :https - # policy.style_src :self, :https - + if Rails.env.production? + policy.default_src :self, :https + policy.font_src :self, :https, :data + policy.img_src :self, :https, :data + policy.object_src :none + policy.script_src :self, :https, :unsafe_inline + policy.style_src :self, :https, :unsafe_inline + policy.connect_src :self, :https, :unsafe_inline, "*.pusher.com" + end # # Specify URI for violation reports # # policy.report_uri "/csp-violation-report-endpoint"