Jeremy Daer
22da6dc19d
* Configure all sources with CSP_* vars. Space separated source list. * Fall back to `config.x.content_security_policy.*` * Move our sources to fizzy-saas References https://github.com/basecamp/fizzy-saas/pull/24
79 lines
3.1 KiB
Ruby
79 lines
3.1 KiB
Ruby
# Be sure to restart your server when you modify this file.
|
|
|
|
# Define an application-wide Content Security Policy.
|
|
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
|
|
#
|
|
# Directives are configurable via environment variables with fallback to config.x
|
|
# settings. This allows fizzy-saas (or other deployments) to extend the base policy
|
|
# without duplicating it.
|
|
#
|
|
# ENV vars (space-separated sources):
|
|
# CSP_DEFAULT_SRC, CSP_SCRIPT_SRC, CSP_STYLE_SRC, CSP_CONNECT_SRC, CSP_FRAME_SRC,
|
|
# CSP_IMG_SRC, CSP_FONT_SRC, CSP_MEDIA_SRC, CSP_WORKER_SRC, CSP_FRAME_ANCESTORS,
|
|
# CSP_FORM_ACTION, CSP_REPORT_URI, CSP_REPORT_ONLY, DISABLE_CSP
|
|
#
|
|
# config.x.content_security_policy.* (string, space-separated string, or array):
|
|
# script_src, style_src, connect_src, frame_src, img_src, font_src, media_src,
|
|
# worker_src, frame_ancestors, form_action, report_uri, report_only
|
|
|
|
Rails.application.configure do
|
|
# Helper to get additional CSP sources from ENV or config.x.
|
|
# Supports: nil, string, space-separated string, or array.
|
|
sources = ->(directive) do
|
|
env_key = "CSP_#{directive.to_s.upcase}"
|
|
value = if ENV.key?(env_key)
|
|
ENV[env_key]
|
|
else
|
|
config.x.content_security_policy.send(directive)
|
|
end
|
|
|
|
case value
|
|
when nil then []
|
|
when Array then value
|
|
when String then value.split
|
|
else []
|
|
end
|
|
end
|
|
|
|
# Report URI and report-only mode
|
|
report_uri = ENV.fetch("CSP_REPORT_URI") { config.x.content_security_policy.report_uri }
|
|
report_only =
|
|
if ENV.key?("CSP_REPORT_ONLY")
|
|
ENV["CSP_REPORT_ONLY"] == "true"
|
|
else
|
|
config.x.content_security_policy.report_only
|
|
end
|
|
|
|
# Generate nonces for importmap and inline scripts
|
|
config.content_security_policy_nonce_generator = ->(request) { SecureRandom.base64(16) }
|
|
config.content_security_policy_nonce_directives = %w[ script-src ]
|
|
|
|
config.content_security_policy do |policy|
|
|
policy.default_src :self, *sources.(:default_src)
|
|
policy.script_src :self, *sources.(:script_src)
|
|
policy.connect_src :self, *sources.(:connect_src)
|
|
policy.frame_src :self, *sources.(:frame_src)
|
|
|
|
# Don't fight user tools: permit inline styles, data:/https: sources, and
|
|
# blob: workers for accessibility extensions, privacy tools, and custom fonts.
|
|
policy.style_src :self, :unsafe_inline, *sources.(:style_src)
|
|
policy.img_src :self, "blob:", "data:", "https:", *sources.(:img_src)
|
|
policy.font_src :self, "data:", "https:", *sources.(:font_src)
|
|
policy.media_src :self, "blob:", "data:", "https:", *sources.(:media_src)
|
|
policy.worker_src :self, "blob:", *sources.(:worker_src)
|
|
|
|
# Security-critical defaults (not configurable)
|
|
policy.object_src :none
|
|
policy.base_uri :none
|
|
|
|
policy.form_action :self, *sources.(:form_action)
|
|
policy.frame_ancestors :self, *sources.(:frame_ancestors)
|
|
|
|
# Specify URI for violation reports (e.g., Sentry CSP endpoint)
|
|
policy.report_uri report_uri if report_uri
|
|
end
|
|
|
|
# Report violations without enforcing the policy.
|
|
config.content_security_policy_report_only = report_only
|
|
end unless ENV["DISABLE_CSP"]
|