mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-10-28 00:16:48 +09:00
Jeremy Daer
9c8f4cd272
The nonce generator runs for every response that carries the policy, so the nonce_id cookie was set on QR codes, logos, avatars and disk-served blobs — all public, shared-cacheable. Those endpoints now opt out of the policy, so no cache can replay one client's identifier and nonce.
13 lines
363 B
Ruby
13 lines
363 B
Ruby
class QrCodeController < ApplicationController
|
|
allow_unauthenticated_access
|
|
content_security_policy false
|
|
|
|
def show
|
|
url = Base64.urlsafe_decode64(params[:id])
|
|
qr_code = RQRCode::QRCode.new(url).as_svg(viewbox: true, fill: :white, color: :black)
|
|
|
|
expires_in 1.year, public: true
|
|
render plain: qr_code, content_type: "image/svg+xml"
|
|
end
|
|
end
|