From 39c4a5c40b3abde1d3dee76a3ccdd326f77f60b0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafael=20Mendon=C3=A7a=20Fran=C3=A7a?= Date: Tue, 30 Jan 2018 17:50:32 -0500 Subject: Disable CSP by default Before this patch, to be able to use webpacker and webconsole we were defining an used default in the script-src policy. White we don't implement the automatic nonce approach defined in https://github.com/rails/rails/issues/31689 it is better to not have any default configuration in Rails 5.2. --- .../initializers/content_security_policy.rb.tt | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/railties/lib/rails/generators/rails/app/templates/config/initializers/content_security_policy.rb.tt b/railties/lib/rails/generators/rails/app/templates/config/initializers/content_security_policy.rb.tt index c82324ae4d..edde7f42b8 100644 --- a/railties/lib/rails/generators/rails/app/templates/config/initializers/content_security_policy.rb.tt +++ b/railties/lib/rails/generators/rails/app/templates/config/initializers/content_security_policy.rb.tt @@ -4,17 +4,17 @@ # For further information see the following documentation # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy -Rails.application.config.content_security_policy do |policy| - policy.default_src :self, :https - policy.font_src :self, :https, :data - policy.img_src :self, :https, :data - policy.object_src :none - policy.script_src :self, :https, :unsafe_inline - policy.style_src :self, :https, :unsafe_inline +# Rails.application.config.content_security_policy do |policy| +# policy.default_src :self, :https +# policy.font_src :self, :https, :data +# policy.img_src :self, :https, :data +# policy.object_src :none +# policy.script_src :self, :https +# policy.style_src :self, :https, :unsafe_inline - # Specify URI for violation reports - # policy.report_uri "/csp-violation-report-endpoint" -end +# # Specify URI for violation reports +# # policy.report_uri "/csp-violation-report-endpoint" +# end # Report CSP violations to a specified URI # For further information see the following documentation: -- cgit v1.2.3