diff options
| author | Andrew White <pixeltrix@users.noreply.github.com> | 2018-02-22 15:32:23 +0000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-02-22 15:32:23 +0000 |
| commit | e20742f12b362676e8f69fe68c3193ad80a90172 (patch) | |
| tree | 6e8a3c3b0206673cc7a27d67750af0f053acc96d /railties/lib/rails/generators | |
| parent | 1c36aa71bd352e3704f424991f77c780853b3ac4 (diff) | |
| parent | 31abee0341cb9d19f0234da7b42dddbabfcd1d4a (diff) | |
| download | rails-e20742f12b362676e8f69fe68c3193ad80a90172.tar.gz rails-e20742f12b362676e8f69fe68c3193ad80a90172.tar.bz2 rails-e20742f12b362676e8f69fe68c3193ad80a90172.zip | |
Merge pull request #32018 from rails/add-nonce-support-to-csp
Add support for automatic nonce generation for Rails UJS
Diffstat (limited to 'railties/lib/rails/generators')
2 files changed, 5 insertions, 1 deletions
diff --git a/railties/lib/rails/generators/rails/app/templates/app/views/layouts/application.html.erb.tt b/railties/lib/rails/generators/rails/app/templates/app/views/layouts/application.html.erb.tt index 5460155b3e..ef715f1368 100644 --- a/railties/lib/rails/generators/rails/app/templates/app/views/layouts/application.html.erb.tt +++ b/railties/lib/rails/generators/rails/app/templates/app/views/layouts/application.html.erb.tt @@ -3,6 +3,7 @@ <head> <title><%= camelized %></title> <%%= csrf_meta_tags %> + <%%= csp_meta_tag %> <%- if options[:skip_javascript] -%> <%%= stylesheet_link_tag 'application', media: 'all' %> diff --git a/railties/lib/rails/generators/rails/app/templates/config/initializers/content_security_policy.rb.tt b/railties/lib/rails/generators/rails/app/templates/config/initializers/content_security_policy.rb.tt index edde7f42b8..38c658548d 100644 --- a/railties/lib/rails/generators/rails/app/templates/config/initializers/content_security_policy.rb.tt +++ b/railties/lib/rails/generators/rails/app/templates/config/initializers/content_security_policy.rb.tt @@ -10,12 +10,15 @@ # policy.img_src :self, :https, :data # policy.object_src :none # policy.script_src :self, :https -# policy.style_src :self, :https, :unsafe_inline +# policy.style_src :self, :https # # Specify URI for violation reports # # policy.report_uri "/csp-violation-report-endpoint" # end +# If you are using UJS then enable automatic nonce generation +# Rails.application.config.content_security_policy_nonce_generator = -> { SecureRandom.base64(16) } + # Report CSP violations to a specified URI # For further information see the following documentation: # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only |