Jeremy Daer 562888251e Enforce a script policy that allows the importmap by hash ...

script-src 'self', object-src 'none' and base-uri 'self', enforced. The
two inline scripts the importmap helper emits are allowed by their
SHA-256, and the origins its URLs point to (a configured asset host, in
any form Rails accepts) are allowed by name. There is no per-request
nonce, so cached pages stay valid.

DISABLE_CONTENT_SECURITY_POLICY=true leaves the policy off, for an
install whose proxy or customization injects scripts.

2026-10-15 19:01:12 -07:00

..

content_security_policy_test.rb

Enforce a script policy that allows the importmap by hash

2026-10-15 19:01:12 -07:00