X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/c77c7d015f224db8c383932c3745e1cbd48eb519..c818dede140055dd305beeca661752e05b4e0b2a:/config/initializers/secure_headers.rb?ds=inline diff --git a/config/initializers/secure_headers.rb b/config/initializers/secure_headers.rb index 9af170623..60f155139 100644 --- a/config/initializers/secure_headers.rb +++ b/config/initializers/secure_headers.rb @@ -1,35 +1,50 @@ -if defined?(CSP_REPORT_URL) - csp_policy = { - :default_src => %w['self'], - :child_src => %w['self'], - :connect_src => %w['self'], - :font_src => %w['none'], - :form_action => %w['self'], - :frame_ancestors => %w['self'], - :frame_src => %w['self'], - :img_src => %w['self' data: www.gravatar.com *.wp.com *.tile.openstreetmap.org *.tile.thunderforest.com *.openstreetmap.fr], - :media_src => %w['none'], - :object_src => %w['self'], - :plugin_types => %w[], - :script_src => %w['self'], - :style_src => %w['self' 'unsafe-inline'], - :report_uri => [CSP_REPORT_URL] - } +csp_policy = { + :preserve_schemes => true, + :default_src => %w['self'], + :child_src => %w['self'], + :connect_src => %w['self'], + :font_src => %w['none'], + :form_action => %w['self'], + :frame_ancestors => %w['self'], + :frame_src => %w['self'], + :img_src => %w['self' data: www.gravatar.com *.wp.com tile.openstreetmap.org *.tile.openstreetmap.org *.tile.thunderforest.com tile.tracestrack.com *.openstreetmap.fr], + :manifest_src => %w['self'], + :media_src => %w['none'], + :object_src => %w['self'], + :plugin_types => %w[], + :script_src => %w['self'], + :style_src => %w['self'], + :worker_src => %w['none'], + :report_uri => [] +} - csp_policy[:img_src] << PIWIK["location"] if defined?(PIWIK) - csp_policy[:script_src] << PIWIK["location"] if defined?(PIWIK) -else - csp_policy = SecureHeaders::OPT_OUT -end +csp_policy[:connect_src] << Settings.matomo["location"] if defined?(Settings.matomo) +csp_policy[:img_src] << Settings.matomo["location"] if defined?(Settings.matomo) +csp_policy[:script_src] << Settings.matomo["location"] if defined?(Settings.matomo) + +csp_policy[:img_src] << Settings.avatar_storage_url if Settings.key?(:avatar_storage_url) +csp_policy[:img_src] << Settings.trace_image_storage_url if Settings.key?(:trace_image_storage_url) + +csp_policy[:report_uri] << Settings.csp_report_url if Settings.key?(:csp_report_url) cookie_policy = { - :secure => SecureHeaders::OPT_OUT, - :httponly => SecureHeaders::OPT_OUT + :httponly => { :only => %w[_osm_session _osm_totp_token] } } SecureHeaders::Configuration.default do |config| config.hsts = SecureHeaders::OPT_OUT - config.csp = SecureHeaders::OPT_OUT - config.csp_report_only = csp_policy + config.referrer_policy = "strict-origin-when-cross-origin" + + if Settings.csp_enforce + config.csp = csp_policy + config.csp_report_only = SecureHeaders::OPT_OUT + elsif Settings.key?(:csp_report_url) + config.csp = SecureHeaders::OPT_OUT + config.csp_report_only = csp_policy + else + config.csp = SecureHeaders::OPT_OUT + config.csp_report_only = SecureHeaders::OPT_OUT + end + config.cookies = cookie_policy end