content_security_policy.rb (1140B)
1 # Be sure to restart your server when you modify this file. 2 3 # Define an application-wide content security policy 4 # For further information see the following documentation 5 # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy 6 7 # Rails.application.configure do 8 # config.content_security_policy do |policy| 9 # policy.default_src :self, :https 10 # policy.font_src :self, :https, :data 11 # policy.img_src :self, :https, :data 12 # policy.object_src :none 13 # policy.script_src :self, :https 14 # policy.style_src :self, :https 15 # # Specify URI for violation reports 16 # # policy.report_uri "/csp-violation-report-endpoint" 17 # end 18 # 19 # # Generate session nonces for permitted importmap and inline scripts 20 # config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s } 21 # config.content_security_policy_nonce_directives = %w(script-src) 22 # 23 # # Report CSP violations to a specified URI. See: 24 # # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only 25 # # config.content_security_policy_report_only = true 26 # end