From fd30a3237c572fc9727a4dc59edbb08b6569a761 Mon Sep 17 00:00:00 2001 From: "yuuji.yaginuma" Date: Fri, 12 Oct 2018 18:14:48 +0900 Subject: Add `connect_src` example to content security policy initializer If want to use `webpack-dev-server` with CSP enabled, need to specify `connect-src`. Related to: https://github.com/rails/webpacker/commit/cd7ecf4d48496341aecd81c0c2f69fe4e50a7cd4 This is a matter of `webpacker`. But since `webpacker` is now used by default, to prevent user confusion, I think that better to include an example of `connect-src.` --- .../app/templates/config/initializers/content_security_policy.rb.tt | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'railties/lib') diff --git a/railties/lib/rails/generators/rails/app/templates/config/initializers/content_security_policy.rb.tt b/railties/lib/rails/generators/rails/app/templates/config/initializers/content_security_policy.rb.tt index d3bcaa5ec8..c517b0f96b 100644 --- a/railties/lib/rails/generators/rails/app/templates/config/initializers/content_security_policy.rb.tt +++ b/railties/lib/rails/generators/rails/app/templates/config/initializers/content_security_policy.rb.tt @@ -11,6 +11,10 @@ # policy.object_src :none # policy.script_src :self, :https # policy.style_src :self, :https +<%- unless options[:skip_javascript] -%> +# # If you are using webpack-dev-server then specify webpack-dev-server host +# policy.connect_src :self, :https, "http://localhost:3035", "ws://localhost:3035" if Rails.env.development? +<%- end -%> # # Specify URI for violation reports # # policy.report_uri "/csp-violation-report-endpoint" -- cgit v1.2.3