Module: SecureHeaders::ContentSecurityPolicy::Constants

Included in:: SecureHeaders::ContentSecurityPolicy

Defined in:: lib/secure_headers/headers/content_security_policy.rb

Constant Summary collapse

DEFAULT_CSP_HEADER =

"default-src https: data: 'unsafe-inline' 'unsafe-eval'; frame-src https: about: javascript:; img-src data:"

HEADER_NAME =

"Content-Security-Policy"

ENV_KEY =

'secure_headers.content_security_policy'

USER_AGENT_PARSER =

UserAgentParser::Parser.new

DIRECTIVES_1_0 =

[
  :default_src,
  :connect_src,
  :font_src,
  :frame_src,
  :img_src,
  :media_src,
  :object_src,
  :sandbox,
  :script_src,
  :style_src,
  :report_uri
].freeze

DIRECTIVES_2_0 =

[
  DIRECTIVES_1_0,
  :base_uri,
  :child_src,
  :form_action,
  :frame_ancestors,
  :plugin_types
].flatten.freeze

DIRECTIVES_3_0 = All the directives currently under consideration for CSP level 3. https://w3c.github.io/webappsec/specs/CSP2/

[
  DIRECTIVES_2_0,
  :manifest_src,
  :reflected_xss
].flatten.freeze

DIRECTIVES_DRAFT = All the directives that are not currently in a formal spec, but have been implemented somewhere.

[
  :block_all_mixed_content,
].freeze

SAFARI_DIRECTIVES =

DIRECTIVES_1_0

FIREFOX_UNSUPPORTED_DIRECTIVES =

[
  :block_all_mixed_content,
  :child_src,
  :plugin_types
].freeze

FIREFOX_DIRECTIVES =

(
  DIRECTIVES_2_0 - FIREFOX_UNSUPPORTED_DIRECTIVES
).freeze

CHROME_DIRECTIVES =

(
  DIRECTIVES_2_0 + DIRECTIVES_DRAFT
).freeze

ALL_DIRECTIVES =

[DIRECTIVES_1_0 + DIRECTIVES_2_0 + DIRECTIVES_3_0 + DIRECTIVES_DRAFT].flatten.uniq.sort

CONFIG_KEY =

:csp