Class: SecureHeaders::ReportingEndpoints

Inherits:
Object
  • Object
show all
Defined in:
lib/secure_headers/headers/reporting_endpoints.rb

Constant Summary collapse

HEADER_NAME = 
"reporting-endpoints".freeze

Class Method Summary collapse

Class Method Details

.make_header(config = nil) ⇒ Object

Public: generate a Reporting-Endpoints header.

The config should be a Hash of endpoint names to URLs. Example: { “csp-endpoint” => “example.com/reports” }

Returns nil if config is OPT_OUT or nil, or a header name and formatted header value based on the config.



15
16
17
18
19
 
# File 'lib/secure_headers/headers/reporting_endpoints.rb', line 15

def make_header(config = nil)
  return if config.nil? || config == OPT_OUT
  validate_config!(config)
  [HEADER_NAME, format_endpoints(config)]
end

.validate_config!(config) ⇒ Object 



21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
 
# File 'lib/secure_headers/headers/reporting_endpoints.rb', line 21

def validate_config!(config)
  case config
  when nil, OPT_OUT
    # valid
  when Hash
    config.each_pair do |name, url|
      if name.is_a?(Symbol)
        name = name.to_s
      end
      unless name.is_a?(String) && !name.empty?
        raise ReportingEndpointsConfigError.new("Endpoint name must be a non-empty string, got: #{name.inspect}")
      end
      unless url.is_a?(String) && !url.empty?
        raise ReportingEndpointsConfigError.new("Endpoint URL must be a non-empty string, got: #{url.inspect}")
      end
      unless url.start_with?("https://")
        raise ReportingEndpointsConfigError.new("Endpoint URLs must use https, got: #{url.inspect}")
      end
    end
  else
    raise TypeError.new("Must be a Hash of endpoint names to URLs. Found #{config.class}: #{config}")
  end
end