Class: SecureHeaders::ContentSecurityPolicyConfig

Inherits:
Object
  • Object
show all
Includes:
DynamicConfig
Defined in:
lib/secure_headers/headers/content_security_policy_config.rb

Direct Known Subclasses

ContentSecurityPolicyReportOnlyConfig

Constant Summary collapse

HEADER_NAME = 
"Content-Security-Policy".freeze
ATTRS = 
PolicyManagement::ALL_DIRECTIVES + PolicyManagement::META_CONFIGS + PolicyManagement::NONCES
DEFAULT =

based on what was suggested in github.com/rails/rails/pull/24961/files

{
  default_src: %w('self' https:),
  font_src: %w('self' https: data:),
  img_src: %w('self' https: data:),
  object_src: %w('none'),
  script_src: %w(https:),
  style_src: %w('self' https: 'unsafe-inline')
}

Class Method Summary collapse

Instance Method Summary collapse

Methods included from DynamicConfig

#==, #append, #directive_value, #dup, included, #initialize, #merge, #merge!, #opt_out?, #to_h, #update_directive

Class Method Details

.attrs ⇒ Object 



127
128
129
 
# File 'lib/secure_headers/headers/content_security_policy_config.rb', line 127

def self.attrs
  ATTRS
end

Instance Method Details

#make_report_only ⇒ Object 



147
148
149
 
# File 'lib/secure_headers/headers/content_security_policy_config.rb', line 147

def make_report_only
  ContentSecurityPolicyReportOnlyConfig.new(self.to_h)
end

#report_only? ⇒ Boolean

Returns:

  • (Boolean) 


143
144
145
 
# File 'lib/secure_headers/headers/content_security_policy_config.rb', line 143

def report_only?
  false
end