maverick/docbrown
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[deploy] Enable CSP in report only mode and use Honeybadger to track violations (#10155)

Browse source
This commit is contained in:
rhymes 2020-09-03 18:45:31 +02:00 • committed by GitHub
parent 536b2c821c
commit 1df3e96652
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 15 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
config/initializers/content_security_policy.rb
View file

@ -5,24 +5,23 @@
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
Rails.application.config.content_security_policy do |policy|
if Rails.env.production?
policy.default_src :self, :https
policy.font_src :self, :https, :data
policy.img_src :self, :https, :data
policy.object_src :none
policy.script_src :self, :https, :unsafe_inline
policy.style_src :self, :https, :unsafe_inline
policy.default_src :self, :https
policy.font_src :self, :https, :data
policy.img_src :self, :https, :data
policy.object_src :none
policy.script_src :self, :https, :unsafe_inline
policy.style_src :self, :https, :unsafe_inline
if Rails.env.development?
# allow webpack-dev-server host as allowed origin for connect-src
webpack_host = "#{ApplicationConfig.app_domain_no_port}:3035"
policy.connect_src :self, :https, :unsafe_inline, "*.pusher.com", "http://#{webpack_host}", "ws://#{webpack_host}"
else
policy.connect_src :self, :https, :unsafe_inline, "*.pusher.com"
end
# # Specify URI for violation reports
# # policy.report_uri "/csp-violation-report-endpoint"
# allow webpack-dev-server host as allowed origin for connect-src
if Rails.env.development?
webpack_host = "#{ApplicationConfig.app_domain_no_port}:3035"
policy.connect_src :self, :https,
"http://#{webpack_host}", "ws://#{webpack_host}"
end
# Specify URI for violation reports
policy.report_uri -> { "https://api.honeybadger.io/v1/browser/csp?api_key=#{ENV['HONEYBADGER_API_KEY']}&report_only=true&env=#{Rails.env}&context[user_id]=#{respond_to?(:current_user) ? current_user&.id : nil}" } # rubocop:disable Layout/LineLength
end
# If you are using UJS then enable automatic nonce generation
@ -31,4 +30,4 @@ end
# Report CSP violations to a specified URI
# For further information see the following documentation:
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only
# Rails.application.config.content_security_policy_report_only = true
Rails.application.config.content_security_policy_report_only = true