diff options
| author | Andrew White <pixeltrix@users.noreply.github.com> | 2018-04-19 08:24:21 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-04-19 08:24:21 +0100 |
| commit | fb2af6f849c8d25732f2c17352c59f2dc8b8320d (patch) | |
| tree | 9ea30543b6b2f68f15d9c0b711054ee035a4b8fe /guides | |
| parent | 7d25b651fa9011b040fab2f19fb315679519edb2 (diff) | |
| parent | ef2af628a9ec1cc4e7b6997a021dd3f85cfe4665 (diff) | |
| download | rails-fb2af6f849c8d25732f2c17352c59f2dc8b8320d.tar.gz rails-fb2af6f849c8d25732f2c17352c59f2dc8b8320d.tar.bz2 rails-fb2af6f849c8d25732f2c17352c59f2dc8b8320d.zip | |
Merge branch 'master' into fix-as-timezone-all
Diffstat (limited to 'guides')
| -rw-r--r-- | guides/source/asset_pipeline.md | 4 | ||||
| -rw-r--r-- | guides/source/security.md | 6 |
2 files changed, 8 insertions, 2 deletions
diff --git a/guides/source/asset_pipeline.md b/guides/source/asset_pipeline.md index 2f5854fed0..88b87b78d2 100644 --- a/guides/source/asset_pipeline.md +++ b/guides/source/asset_pipeline.md @@ -728,8 +728,8 @@ Rails.application.config.assets.precompile += %w( admin.js admin.css ) NOTE. Always specify an expected compiled filename that ends with `.js` or `.css`, even if you want to add Sass or CoffeeScript files to the precompile array. -The task also generates a `.sprockets-manifest-md5hash.json` (where `md5hash` is -an MD5 hash) that contains a list with all your assets and their respective +The task also generates a `.sprockets-manifest-randomhex.json` (where `randomhex` is +a 16-byte random hex string) that contains a list with all your assets and their respective fingerprints. This is used by the Rails helper methods to avoid handing the mapping requests back to Sprockets. A typical manifest file looks like: diff --git a/guides/source/security.md b/guides/source/security.md index a21526d895..3ac50fb147 100644 --- a/guides/source/security.md +++ b/guides/source/security.md @@ -1182,6 +1182,12 @@ as part of `html_options`. Example: <% end -%> ``` +The same works with `javascript_include_tag`: + +```html+erb +<%= javascript_include_tag "script", nonce: true %> +``` + Use [`csp_meta_tag`](http://api.rubyonrails.org/classes/ActionView/Helpers/CspHelper.html#method-i-csp_meta_tag) helper to create a meta tag "csp-nonce" with the per-session nonce value for allowing inline `<script>` tags. |