mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-08-28 09:32:37 +09:00
Jeremy Daer
f09110c14d
Campfire ships no CSP today (the initializer is the stock, fully-commented file). This adds a conservative Report-Only policy — default-src 'self'; object-src 'none'; base-uri/frame-ancestors/form-action 'self' — so browsers evaluate and report violations without enforcing anything. Rendering and behavior are unaffected. Next steps: wire a report endpoint, tune against observed violations, then flip content_security_policy_report_only off to enforce.
26 lines
1.0 KiB
Ruby
26 lines
1.0 KiB
Ruby
# Be sure to restart your server when you modify this file.
|
|
|
|
# Baseline application-wide Content-Security-Policy, deployed in Report-Only
|
|
# mode: browsers evaluate the policy and report violations (once a report
|
|
# endpoint is wired up) but enforce nothing, so rendering cannot break.
|
|
# Tune the policy against observed violations, then flip
|
|
# `content_security_policy_report_only` off to enforce it.
|
|
#
|
|
# See the Securing Rails Applications Guide for more information:
|
|
# https://guides.rubyonrails.org/security.html#content-security-policy-header
|
|
|
|
Rails.application.configure do
|
|
config.content_security_policy do |policy|
|
|
policy.default_src :self
|
|
policy.object_src :none
|
|
policy.base_uri :self
|
|
policy.frame_ancestors :self
|
|
policy.form_action :self
|
|
# Specify URI for violation reports once a report sink is available
|
|
# policy.report_uri "/csp-violation-report-endpoint"
|
|
end
|
|
|
|
# Report violations without enforcing the policy.
|
|
config.content_security_policy_report_only = true
|
|
end
|