annotate config/initializers/content_security_policy.rb @ 243:bc2f45058c9e legit-client

Prevent caching of rate limited error and combine response handling
author nanaya <me@nanaya.net>
date Sun, 16 Jul 2023 08:53:59 +0900
parents ad6264cca788
children 89f6c0016bab
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
185
f67f3ad50270 Update to latest rails and gems
nanaya <me@nanaya.pro>
parents:
diff changeset
1 # Be sure to restart your server when you modify this file.
f67f3ad50270 Update to latest rails and gems
nanaya <me@nanaya.pro>
parents:
diff changeset
2
f67f3ad50270 Update to latest rails and gems
nanaya <me@nanaya.pro>
parents:
diff changeset
3 # Define an application-wide content security policy
f67f3ad50270 Update to latest rails and gems
nanaya <me@nanaya.pro>
parents:
diff changeset
4 # For further information see the following documentation
f67f3ad50270 Update to latest rails and gems
nanaya <me@nanaya.pro>
parents:
diff changeset
5 # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
f67f3ad50270 Update to latest rails and gems
nanaya <me@nanaya.pro>
parents:
diff changeset
6
223
ad6264cca788 Update to rails 7
nanaya <me@nanaya.pro>
parents: 214
diff changeset
7 # Rails.application.configure do
ad6264cca788 Update to rails 7
nanaya <me@nanaya.pro>
parents: 214
diff changeset
8 # config.content_security_policy do |policy|
ad6264cca788 Update to rails 7
nanaya <me@nanaya.pro>
parents: 214
diff changeset
9 # policy.default_src :self, :https
ad6264cca788 Update to rails 7
nanaya <me@nanaya.pro>
parents: 214
diff changeset
10 # policy.font_src :self, :https, :data
ad6264cca788 Update to rails 7
nanaya <me@nanaya.pro>
parents: 214
diff changeset
11 # policy.img_src :self, :https, :data
ad6264cca788 Update to rails 7
nanaya <me@nanaya.pro>
parents: 214
diff changeset
12 # policy.object_src :none
ad6264cca788 Update to rails 7
nanaya <me@nanaya.pro>
parents: 214
diff changeset
13 # policy.script_src :self, :https
ad6264cca788 Update to rails 7
nanaya <me@nanaya.pro>
parents: 214
diff changeset
14 # policy.style_src :self, :https
ad6264cca788 Update to rails 7
nanaya <me@nanaya.pro>
parents: 214
diff changeset
15 # # Specify URI for violation reports
ad6264cca788 Update to rails 7
nanaya <me@nanaya.pro>
parents: 214
diff changeset
16 # # policy.report_uri "/csp-violation-report-endpoint"
ad6264cca788 Update to rails 7
nanaya <me@nanaya.pro>
parents: 214
diff changeset
17 # end
ad6264cca788 Update to rails 7
nanaya <me@nanaya.pro>
parents: 214
diff changeset
18 #
ad6264cca788 Update to rails 7
nanaya <me@nanaya.pro>
parents: 214
diff changeset
19 # # Generate session nonces for permitted importmap and inline scripts
ad6264cca788 Update to rails 7
nanaya <me@nanaya.pro>
parents: 214
diff changeset
20 # config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }
ad6264cca788 Update to rails 7
nanaya <me@nanaya.pro>
parents: 214
diff changeset
21 # config.content_security_policy_nonce_directives = %w(script-src)
ad6264cca788 Update to rails 7
nanaya <me@nanaya.pro>
parents: 214
diff changeset
22 #
ad6264cca788 Update to rails 7
nanaya <me@nanaya.pro>
parents: 214
diff changeset
23 # # Report CSP violations to a specified URI. See:
ad6264cca788 Update to rails 7
nanaya <me@nanaya.pro>
parents: 214
diff changeset
24 # # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only
ad6264cca788 Update to rails 7
nanaya <me@nanaya.pro>
parents: 214
diff changeset
25 # # config.content_security_policy_report_only = true
185
f67f3ad50270 Update to latest rails and gems
nanaya <me@nanaya.pro>
parents:
diff changeset
26 # end