Jeremy Daer 26b3d2abb0 Leave the scheme off this origin's script sources ...

Behind a proxy that terminates TLS without X-Forwarded-Proto, Rails sees
http while the page is https, and an http source on a non-default port
doesn't match. A source without a scheme takes the page's own.

(cherry picked from commit 0a494a10cb)

2026-10-17 00:47:41 -07:00

..

content_security_policy_test.rb

Leave the scheme off this origin's script sources

2026-10-17 00:47:41 -07:00