config/initializers/content_security_policy.rb


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

# frozen_string_literal: true
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
require 'booru/config'

in_staging_or_production = Rails.env.staging? || Rails.env.production?

Rails.application.config.content_security_policy do |policy|
  policy.default_src     :self, :data, "'unsafe-inline'", 'js-agent.newrelic.com', *(Booru::CONFIG.settings[:origin_hosts] + [Booru::CONFIG.settings[:cdn_url_root]])
  policy.object_src      :none
  policy.frame_ancestors :none
  policy.frame_src       :self
  policy.form_action     :self
  policy.manifest_src    :self

  if in_staging_or_production
    policy.img_src :self, :data, Booru::CONFIG.settings[:cdn_url_root], Booru::CONFIG.settings[:camo_host]
  else
    policy.img_src '*', :data
  end

  policy.block_all_mixed_content

  # Specify URI for violation reports
  # policy.report_uri "/csp-violation-report-endpoint"
end