once-campfire/config/initializers/active_storage.rb at 9c8f4cd2729745cfba2599ab9b38096c1b416019 - once-campfire - Vectorsigma Gitea

public/once-campfire

0 Fork 0

mirror of https://github.com/basecamp/once-campfire.git synced 2026-10-28 08:26:48 +09:00

Files

T

Jeremy Daer 9c8f4cd272 Keep the CSP nonce cookie off public cacheable responses

The nonce generator runs for every response that carries the policy, so
the nonce_id cookie was set on QR codes, logos, avatars and disk-served
blobs — all public, shared-cacheable. Those endpoints now opt out of the
policy, so no cache can replay one client's identifier and nonce.

2026-09-13 17:01:24 -07:00

8 lines

258 B

Ruby

Raw Blame History

 ActiveSupport.on_load(:active_storage_blob) do
   ActiveStorage::DiskController.content_security_policy false, only: :show
   ActiveStorage::DiskController.after_action only: :show do
     response.set_header("Cache-Control", "max-age=3600, public")
   end
 end