X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/673b58f96f3acfd0281c62a2a7f080825b6fb28b..be7248bace3b5dcd4498df75d09a70fff75a86e5:/config/initializers/secure_headers.rb?ds=sidebyside diff --git a/config/initializers/secure_headers.rb b/config/initializers/secure_headers.rb index b0b45aa13..778b5b827 100644 --- a/config/initializers/secure_headers.rb +++ b/config/initializers/secure_headers.rb @@ -1,34 +1,50 @@ -if defined?(CSP_REPORT_URL) - csp_policy = { - :default_src => %w['self'], - :child_src => %w['self'], - :connect_src => %w['self'], - :font_src => %w['none'], - :form_action => %w['self'], - :frame_ancestors => %w['self'], - :img_src => %w['self' data: www.gravatar.com *.wp.com *.tile.openstreetmap.org *.tile.thunderforest.com *.openstreetmap.fr], - :media_src => %w['none'], - :object_src => %w['self'], - :plugin_types => %w[], - :script_src => %w['self'], - :style_src => %w['self' 'unsafe-inline'], - :report_uri => [CSP_REPORT_URL] - } +csp_policy = { + :preserve_schemes => true, + :default_src => %w['self'], + :child_src => %w['self'], + :connect_src => %w['self'], + :font_src => %w['none'], + :form_action => %w['self'], + :frame_ancestors => %w['self'], + :frame_src => %w['self'], + :img_src => %w['self' data: www.gravatar.com *.wp.com tile.openstreetmap.org *.tile.openstreetmap.org *.tile.thunderforest.com tileserver.memomaps.de tile.tracestrack.com *.openstreetmap.fr], + :manifest_src => %w['self'], + :media_src => %w['none'], + :object_src => %w['self'], + :plugin_types => %w[], + :script_src => %w['self'], + :style_src => %w['self'], + :worker_src => %w['none'], + :report_uri => [] +} - csp_policy[:img_src] << PIWIK["location"] if defined?(PIWIK) - csp_policy[:script_src] << PIWIK["location"] if defined?(PIWIK) -else - csp_policy = SecureHeaders::OPT_OUT -end +csp_policy[:connect_src] << Settings.matomo["location"] if defined?(Settings.matomo) +csp_policy[:img_src] << Settings.matomo["location"] if defined?(Settings.matomo) +csp_policy[:script_src] << Settings.matomo["location"] if defined?(Settings.matomo) + +csp_policy[:img_src] << Settings.avatar_storage_url if Settings.key?(:avatar_storage_url) +csp_policy[:img_src] << Settings.trace_image_storage_url if Settings.key?(:trace_image_storage_url) + +csp_policy[:report_uri] << Settings.csp_report_url if Settings.key?(:csp_report_url) cookie_policy = { - :secure => SecureHeaders::OPT_OUT, - :httponly => SecureHeaders::OPT_OUT + :httponly => { :only => %w[_osm_session _osm_totp_token] } } SecureHeaders::Configuration.default do |config| config.hsts = SecureHeaders::OPT_OUT - config.csp = SecureHeaders::OPT_OUT - config.csp_report_only = csp_policy + config.referrer_policy = "strict-origin-when-cross-origin" + + if Settings.csp_enforce + config.csp = csp_policy + config.csp_report_only = SecureHeaders::OPT_OUT + elsif Settings.key?(:csp_report_url) + config.csp = SecureHeaders::OPT_OUT + config.csp_report_only = csp_policy + else + config.csp = SecureHeaders::OPT_OUT + config.csp_report_only = SecureHeaders::OPT_OUT + end + config.cookies = cookie_policy end