X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/7e5cbe87ed37f9cba8224fa4049047d7f981f66a..1ce5d7dec1503416ab10d17ec2d27ef7e0ab86e9:/config/initializers/secure_headers.rb?ds=sidebyside diff --git a/config/initializers/secure_headers.rb b/config/initializers/secure_headers.rb index 53ab76808..778b5b827 100644 --- a/config/initializers/secure_headers.rb +++ b/config/initializers/secure_headers.rb @@ -7,7 +7,7 @@ csp_policy = { :form_action => %w['self'], :frame_ancestors => %w['self'], :frame_src => %w['self'], - :img_src => %w['self' data: www.gravatar.com *.wp.com tile.openstreetmap.org *.tile.openstreetmap.org *.tile.thunderforest.com tileserver.memomaps.de *.openstreetmap.fr], + :img_src => %w['self' data: www.gravatar.com *.wp.com tile.openstreetmap.org *.tile.openstreetmap.org *.tile.thunderforest.com tileserver.memomaps.de tile.tracestrack.com *.openstreetmap.fr], :manifest_src => %w['self'], :media_src => %w['none'], :object_src => %w['self'], @@ -28,7 +28,7 @@ csp_policy[:img_src] << Settings.trace_image_storage_url if Settings.key?(:trace csp_policy[:report_uri] << Settings.csp_report_url if Settings.key?(:csp_report_url) cookie_policy = { - :httponly => { :only => ["_osm_session"] } + :httponly => { :only => %w[_osm_session _osm_totp_token] } } SecureHeaders::Configuration.default do |config|