Add content security policy (#2)

renuo · Nov 4, 2024 · 1aaa7f7 · 1aaa7f7
1 parent 4f9e43e
commit 1aaa7f7
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 1 deletion.
diff --git a/app/views/layouts/hotsheet/application.html.erb b/app/views/layouts/hotsheet/application.html.erb
@@ -6,7 +6,8 @@
     <%= csp_meta_tag %>
     <%= yield :head %>
     <%= stylesheet_link_tag "hotsheet/application", media: :all %>
-    <%= javascript_include_tag "hotsheet/application", "data-turbolinks-track": "reload", type: "module" %>
+    <%= javascript_include_tag "hotsheet/application", "data-turbolinks-track": :reload,
+          type: :module, nonce: content_security_policy_nonce, defer: true %>
   </head>
   <body>
     <%= render "layouts/hotsheet/sidebar" %>

diff --git a/config/initializers/hotsheet/content_security_policy.rb b/config/initializers/hotsheet/content_security_policy.rb
@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+Rails.application.configure do
+  config.content_security_policy do |csp|
+    csp.default_src :none
+    csp.connect_src :self
+    csp.img_src :self
+    csp.script_src :strict_dynamic
+    csp.style_src :self, :unsafe_inline
+  end
+
+  config.content_security_policy_nonce_directives = %w[script-src]
+  config.content_security_policy_nonce_generator = ->(_) { SecureRandom.base64 18 }
+end