From f09110c14d08c21723a80e75ffd60eea5feee4b0 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Sat, 8 Aug 2026 14:27:51 -0700 Subject: [PATCH] Add a Report-Only Content-Security-Policy baseline MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Campfire ships no CSP today (the initializer is the stock, fully-commented file). This adds a conservative Report-Only policy — default-src 'self'; object-src 'none'; base-uri/frame-ancestors/form-action 'self' — so browsers evaluate and report violations without enforcing anything. Rendering and behavior are unaffected. Next steps: wire a report endpoint, tune against observed violations, then flip content_security_policy_report_only off to enforce. --- .../initializers/content_security_policy.rb | 40 +++++++++---------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb index 54f47cf..7453ea7 100644 --- a/config/initializers/content_security_policy.rb +++ b/config/initializers/content_security_policy.rb @@ -1,25 +1,25 @@ # Be sure to restart your server when you modify this file. -# Define an application-wide content security policy. +# Baseline application-wide Content-Security-Policy, deployed in Report-Only +# mode: browsers evaluate the policy and report violations (once a report +# endpoint is wired up) but enforce nothing, so rendering cannot break. +# Tune the policy against observed violations, then flip +# `content_security_policy_report_only` off to enforce it. +# # See the Securing Rails Applications Guide for more information: # https://guides.rubyonrails.org/security.html#content-security-policy-header -# Rails.application.configure do -# config.content_security_policy do |policy| -# policy.default_src :self, :https -# policy.font_src :self, :https, :data -# policy.img_src :self, :https, :data -# policy.object_src :none -# policy.script_src :self, :https -# policy.style_src :self, :https -# # Specify URI for violation reports -# # policy.report_uri "/csp-violation-report-endpoint" -# end -# -# # Generate session nonces for permitted importmap and inline scripts -# config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s } -# config.content_security_policy_nonce_directives = %w(script-src) -# -# # Report violations without enforcing the policy. -# # config.content_security_policy_report_only = true -# end +Rails.application.configure do + config.content_security_policy do |policy| + policy.default_src :self + policy.object_src :none + policy.base_uri :self + policy.frame_ancestors :self + policy.form_action :self + # Specify URI for violation reports once a report sink is available + # policy.report_uri "/csp-violation-report-endpoint" + end + + # Report violations without enforcing the policy. + config.content_security_policy_report_only = true +end