X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/c5ef6404f5782c8305f9d1d25d2c99a545cdd9a1..f91dd6afc21fdf17cd9c3fa71784540d3f245ddf:/config/initializers/secure_headers.rb diff --git a/config/initializers/secure_headers.rb b/config/initializers/secure_headers.rb index cd428d7dd..c97762a37 100644 --- a/config/initializers/secure_headers.rb +++ b/config/initializers/secure_headers.rb @@ -1,26 +1,42 @@ -policy = if defined?(CSP_REPORT_URL) - { - :default_src => %w('self'), - :child_src => %w('self'), - :connect_src => %w('self'), - :font_src => %w('none'), - :form_action => %w('self'), - :frame_ancestors => %w('self'), - :img_src => %w('self' data: www.gravatar.com *.wp.com *.tile.openstreetmap.org *.tile.thunderforest.com *.openstreetmap.fr), - :media_src => %w('none'), - :object_src => %w('self'), - :plugin_types => %w('none'), - :script_src => %w('self'), - :style_src => %w('self' 'unsafe-inline'), - :report_uri => [CSP_REPORT_URL] - } - else - SecureHeaders::OPT_OUT - end +csp_policy = { + :preserve_schemes => true, + :default_src => %w['self'], + :child_src => %w['self'], + :connect_src => %w['self'], + :font_src => %w['none'], + :form_action => %w['self'], + :frame_ancestors => %w['self'], + :frame_src => %w['self'], + :img_src => %w['self' data: www.gravatar.com *.wp.com tile.openstreetmap.org *.tile.openstreetmap.org *.tile.thunderforest.com tileserver.memomaps.de *.openstreetmap.fr], + :manifest_src => %w['self'], + :media_src => %w['none'], + :object_src => %w['self'], + :plugin_types => %w[], + :script_src => %w['self'], + :style_src => %w['self'], + :worker_src => %w['none'], + :report_uri => [] +} -policy[:script_src] << PIWIK["location"] if defined?(PIWIK) +csp_policy[:connect_src] << PIWIK["location"] if defined?(PIWIK) +csp_policy[:img_src] << PIWIK["location"] if defined?(PIWIK) +csp_policy[:script_src] << PIWIK["location"] if defined?(PIWIK) + +csp_policy[:img_src] << Settings.storage_url if Settings.key?(:storage_url) + +csp_policy[:report_uri] << Settings.csp_report_url if Settings.key?(:csp_report_url) SecureHeaders::Configuration.default do |config| - config.csp = SecureHeaders::OPT_OUT - config.csp_report_only = policy + config.hsts = SecureHeaders::OPT_OUT + + if Settings.csp_enforce + config.csp = csp_policy + config.csp_report_only = SecureHeaders::OPT_OUT + elsif Settings.key?(:csp_report_url) + config.csp = SecureHeaders::OPT_OUT + config.csp_report_only = csp_policy + else + config.csp = SecureHeaders::OPT_OUT + config.csp_report_only = SecureHeaders::OPT_OUT + end end