|
1 | 1 | # Be sure to restart your server when you modify this file. |
2 | 2 |
|
3 | | -# Define an application-wide content security policy |
4 | | -# For further information see the following documentation |
5 | | -# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy |
6 | | - |
7 | | -# Rails.application.config.content_security_policy do |policy| |
8 | | -# policy.default_src :self, :https |
9 | | -# policy.font_src :self, :https, :data |
10 | | -# policy.img_src :self, :https, :data |
11 | | -# policy.object_src :none |
12 | | -# policy.script_src :self, :https |
13 | | -# Allow @vite/client to hot reload javascript changes in development |
14 | | -# policy.script_src *policy.script_src, :unsafe_eval, "http://#{ ViteRuby.config.host_with_port }" if Rails.env.development? # rubocop:disable Layout/LineLength |
15 | | - |
16 | | -# You may need to enable this in production as well depending on your setup. |
17 | | -# policy.script_src *policy.script_src, :blob if Rails.env.test? |
18 | | - |
19 | | -# policy.style_src :self, :https |
20 | | -# Allow @vite/client to hot reload style changes in development |
21 | | -# policy.style_src *policy.style_src, :unsafe_inline if Rails.env.development? |
22 | | - |
23 | | -# # If you are using webpack-dev-server then specify webpack-dev-server host |
24 | | -# policy.connect_src :self, :https, "http://localhost:3035", "ws://localhost:3035" if Rails.env.development? |
| 3 | +# Define an application-wide content security policy. |
| 4 | +# See the Securing Rails Applications Guide for more information: |
| 5 | +# https://guides.rubyonrails.org/security.html#content-security-policy-header |
| 6 | + |
| 7 | +# Rails.application.configure do |
| 8 | +# config.content_security_policy do |policy| |
| 9 | +# policy.default_src :self, :https |
| 10 | +# policy.font_src :self, :https, :data |
| 11 | +# policy.img_src :self, :https, :data |
| 12 | +# policy.object_src :none |
| 13 | +# policy.script_src :self, :https |
| 14 | +# policy.style_src :self, :https |
| 15 | +# # Specify URI for violation reports |
| 16 | +# # policy.report_uri "/csp-violation-report-endpoint" |
| 17 | +# end |
25 | 18 | # |
26 | | -# Allow @vite/client to hot reload changes in development |
27 | | -# policy.connect_src *policy.connect_src, "ws://#{ ViteRuby.config.host_with_port }" if Rails.env.development? |
28 | | - |
29 | | -# # Specify URI for violation reports |
30 | | -# # policy.report_uri "/csp-violation-report-endpoint" |
| 19 | +# # Generate session nonces for permitted importmap, inline scripts, and inline styles. |
| 20 | +# config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s } |
| 21 | +# config.content_security_policy_nonce_directives = %w(script-src style-src) |
| 22 | +# |
| 23 | +# # Automatically add `nonce` to `javascript_tag`, `javascript_include_tag`, and `stylesheet_link_tag` |
| 24 | +# # if the corresponding directives are specified in `content_security_policy_nonce_directives`. |
| 25 | +# # config.content_security_policy_nonce_auto = true |
| 26 | +# |
| 27 | +# # Report violations without enforcing the policy. |
| 28 | +# # config.content_security_policy_report_only = true |
31 | 29 | # end |
32 | | - |
33 | | -# If you are using UJS then enable automatic nonce generation |
34 | | -# Rails.application.config.content_security_policy_nonce_generator = -> request { SecureRandom.base64(16) } |
35 | | - |
36 | | -# Set the nonce only to specific directives |
37 | | -# Rails.application.config.content_security_policy_nonce_directives = %w(script-src) |
38 | | - |
39 | | -# Report CSP violations to a specified URI |
40 | | -# For further information see the following documentation: |
41 | | -# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only |
42 | | -# Rails.application.config.content_security_policy_report_only = true |
0 commit comments