X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/0e78061cdba5cfb3f299f57b7643d2b396ee235b..7a85ce0c12cf4d75561c35e2ff28e718a390d622:/config/initializers/secure_headers.rb?ds=sidebyside diff --git a/config/initializers/secure_headers.rb b/config/initializers/secure_headers.rb index c97762a37..53ab76808 100644 --- a/config/initializers/secure_headers.rb +++ b/config/initializers/secure_headers.rb @@ -18,16 +18,22 @@ csp_policy = { :report_uri => [] } -csp_policy[:connect_src] << PIWIK["location"] if defined?(PIWIK) -csp_policy[:img_src] << PIWIK["location"] if defined?(PIWIK) -csp_policy[:script_src] << PIWIK["location"] if defined?(PIWIK) +csp_policy[:connect_src] << Settings.matomo["location"] if defined?(Settings.matomo) +csp_policy[:img_src] << Settings.matomo["location"] if defined?(Settings.matomo) +csp_policy[:script_src] << Settings.matomo["location"] if defined?(Settings.matomo) -csp_policy[:img_src] << Settings.storage_url if Settings.key?(:storage_url) +csp_policy[:img_src] << Settings.avatar_storage_url if Settings.key?(:avatar_storage_url) +csp_policy[:img_src] << Settings.trace_image_storage_url if Settings.key?(:trace_image_storage_url) csp_policy[:report_uri] << Settings.csp_report_url if Settings.key?(:csp_report_url) +cookie_policy = { + :httponly => { :only => ["_osm_session"] } +} + SecureHeaders::Configuration.default do |config| config.hsts = SecureHeaders::OPT_OUT + config.referrer_policy = "strict-origin-when-cross-origin" if Settings.csp_enforce config.csp = csp_policy @@ -39,4 +45,6 @@ SecureHeaders::Configuration.default do |config| config.csp = SecureHeaders::OPT_OUT config.csp_report_only = SecureHeaders::OPT_OUT end + + config.cookies = cookie_policy end