From 69d764f8b33d536aa98a22463a03a991f4828fb0 Mon Sep 17 00:00:00 2001 From: Jane Sandberg Date: Tue, 1 Oct 2024 13:15:47 -0700 Subject: [PATCH] CSP: add additional restrictions (#854) object-src none and base-uri none are recommended by https://web.dev/articles/strict-csp frame-ancestors none can be added since lib-jobs has no reason to be embedded in an iframe. This is an additional protection, on top of our X-Frame-Options: SameOrigin --- .../initializers/content_security_policy.rb | 20 +++---------------- 1 file changed, 3 insertions(+), 17 deletions(-) diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb index 763f699c..4c60e7fc 100644 --- a/config/initializers/content_security_policy.rb +++ b/config/initializers/content_security_policy.rb @@ -1,24 +1,10 @@ # frozen_string_literal: true -# Be sure to restart your server when you modify this file. - -# Define an application-wide content security policy -# For further information see the following documentation -# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy - -# Rails.application.config.content_security_policy do |policy| -# policy.default_src :self, :https -# policy.font_src :self, :https, :data -# policy.img_src :self, :https, :data -# policy.object_src :none -# policy.script_src :self, :https -# policy.style_src :self, :https - -# # Specify URI for violation reports -# # policy.report_uri "/csp-violation-report-endpoint" -# end Rails.application.config.content_security_policy do |policy| policy.script_src :self, :https, :unsafe_eval + policy.object_src :none + policy.base_uri :none + policy.frame_ancestors :none end # If you are using UJS then enable automatic nonce generation