You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
68 lines
2.2 KiB
68 lines
2.2 KiB
force_ssl = %w[production].any? { |a| Rails.env == a } ? true : false |
|
|
|
# rubocop:disable Lint/PercentStringArray |
|
default_src = force_ssl ? %w(https: 'self') : %w('self') |
|
connect_src = %w('self') |
|
font_src = %w('self' data:) |
|
img_src = %w('self' data:) |
|
media_src = %w('self' data:) |
|
object_src = %w('self') |
|
script_src = %w('self' 'unsafe-inline' 'unsafe-eval') |
|
style_src = %w('self' 'unsafe-inline' data:) |
|
frame_ancestors_src = %w('self') |
|
|
|
img_src << "*.google-analytics.com bam.nr-data.net stats.g.doubleclick.net" |
|
connect_src << "*.google-analytics.com bam.nr-data.net cloudflareinsights.com " |
|
font_src << "fonts.gstatic.com" |
|
script_src << "www.google-analytics.com www.googletagmanager.com *.newrelic.com bam.nr-data.net *.cloudflare.com *.cloudflareinsights.com code.jquery.com" |
|
script_src << "www.recaptcha.net www.gstatic.com" if ENV["RECAPTCHA_ENABLED"] == "on" |
|
|
|
if ENV["SENTRY_DSN"].present? |
|
connect_src << "*.ingest.sentry.io" |
|
script_src << "*.sentry-cdn.com" |
|
end |
|
|
|
object_src << "application/x-shockwave-flash application/pdf" |
|
|
|
csp = { |
|
preserve_schemes: force_ssl, |
|
default_src: default_src, |
|
block_all_mixed_content: force_ssl, |
|
connect_src: connect_src.uniq, |
|
font_src: font_src.uniq, |
|
form_action: %w('self'), |
|
frame_ancestors: frame_ancestors_src.uniq, |
|
img_src: img_src.uniq, |
|
manifest_src: %w('self'), |
|
media_src: media_src.uniq, |
|
object_src: object_src.uniq, |
|
sandbox: false, |
|
script_src: script_src.uniq, |
|
style_src: style_src.uniq, |
|
worker_src: %w['self' blob:], |
|
upgrade_insecure_requests: force_ssl |
|
} |
|
# rubocop:enable Lint/PercentStringArray |
|
|
|
SecureHeaders::Configuration.default do |config| |
|
config.cookies = { |
|
secure: force_ssl || SecureHeaders::OPT_OUT, |
|
httponly: true, |
|
samesite: { |
|
lax: true |
|
} |
|
} |
|
config.x_frame_options = "DENY" |
|
config.x_content_type_options = "nosniff" |
|
config.x_xss_protection = "1; mode=block" |
|
config.x_download_options = "noopen" |
|
config.x_permitted_cross_domain_policies = "none" |
|
config.referrer_policy = %w(origin-when-cross-origin strict-origin-when-cross-origin) |
|
|
|
config.csp = csp |
|
|
|
if ENV["REPORT_URI_URL"].present? |
|
config.csp[:report_uri] ||= %w() |
|
config.csp[:report_uri] << ENV["REPORT_URI_URL"] |
|
end |
|
end
|
|
|