cst1/openstreetmap-website
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add support for Content-Security-Policy

Browse source 
Currently this is report only, and disabled unless a report URL has
been set in the application configuration.
This commit is contained in:
Tom Hughes 2017-02-26 19:34:31 +00:00
parent 8db0548119
commit 40a8e5caf5
7 changed files with 57 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

24
config/initializers/secure_headers.rb Normal file
View file

@ -0,0 +1,24 @@
policy = if defined?(CSP_REPORT_URL)
{
:default_src => %w('self'),
:child_src => %w('self'),
:connect_src => %w('self'),
:font_src => %w('none'),
:form_action => %w('self'),
:frame_ancestors => %w('self'),
:img_src => %w('self' data: www.gravatar.com *.wp.com *.tile.openstreetmap.org *.tile.thunderforest.com *.openstreetmap.fr),
:media_src => %w('none'),
:object_src => %w('self'),
:plugin_types => %w('none'),
:script_src => %w('self' 'unsafe-inline'),
:style_src => %w('self' 'unsafe-inline'),
:report_uri => [CSP_REPORT_URL]
}
else
SecureHeaders::OPT_OUT
end
SecureHeaders::Configuration.default do |config|
config.csp = SecureHeaders::OPT_OUT
config.csp_report_only = policy
end