DGNum/demarches-normaliennes
15
1
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity

remove notification to report-uri in production

Browse source
This commit is contained in:
clemkeirua 2019-11-07 17:21:45 +01:00
parent 8d8be8d033
commit 6351eabfdd
1 changed files with 4 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
config/initializers/content_security_policy.rb
View file

@ -1,9 +1,8 @@
Rails.application.config.content_security_policy do |policy| Rails.application.config.content_security_policy do |policy|
# En cas de non respect d'une des règles, faire un POST sur cette URL if Rails.env.development?
if Rails.env.production? # les CSP ne sont pas appliquées en dev: on notifie cependant une url quelconque de la violation
policy.report_uri "https://demarchessimplifieestest.report-uri.com/r/d/csp/reportOnly" # pour détecter les erreurs lors de l'ajout d'une nouvelle brique externe durant le développement
else policy.report_uri "http://#{ENV['APP_HOST']}/csp/"
policy.report_uri "http://#{ENV['APP_HOST']}/csp/" # ne pas notifier report-uri en dev/test
end end
# Whitelist image # Whitelist image
policy.img_src :self, "*.openstreetmap.org", "static.demarches-simplifiees.fr", "*.cloud.ovh.net", "stats.data.gouv.fr", "*", :data policy.img_src :self, "*.openstreetmap.org", "static.demarches-simplifiees.fr", "*.cloud.ovh.net", "stats.data.gouv.fr", "*", :data