X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/dbd88d893f3c3fce9cafd666b94396988646d81f..1096b3b8e2d986bc522c46d8d50b723dfd4dfff8:/config/initializers/secure_headers.rb diff --git a/config/initializers/secure_headers.rb b/config/initializers/secure_headers.rb index 59fe4225d..f09759fa6 100644 --- a/config/initializers/secure_headers.rb +++ b/config/initializers/secure_headers.rb @@ -1,27 +1,49 @@ -if defined?(CSP_REPORT_URL) - policy = { - :default_src => %w['self'], - :child_src => %w['self'], - :connect_src => %w['self'], - :font_src => %w['none'], - :form_action => %w['self'], - :frame_ancestors => %w['self'], - :img_src => %w['self' data: www.gravatar.com *.wp.com *.tile.openstreetmap.org *.tile.thunderforest.com *.openstreetmap.fr], - :media_src => %w['none'], - :object_src => %w['self'], - :plugin_types => %w['none'], - :script_src => %w['self'], - :style_src => %w['self' 'unsafe-inline'], - :report_uri => [CSP_REPORT_URL] - } +csp_policy = { + :preserve_schemes => true, + :default_src => %w['self'], + :child_src => %w['self'], + :connect_src => %w['self'], + :font_src => %w['none'], + :form_action => %w['self'], + :frame_ancestors => %w['self'], + :frame_src => %w['self'], + :img_src => %w['self' data: www.gravatar.com *.wp.com tile.openstreetmap.org *.tile.openstreetmap.org *.tile.thunderforest.com tileserver.memomaps.de *.openstreetmap.fr], + :manifest_src => %w['self'], + :media_src => %w['none'], + :object_src => %w['self'], + :plugin_types => %w[], + :script_src => %w['self'], + :style_src => %w['self'], + :worker_src => %w['none'], + :report_uri => [] +} - policy[:script_src] << PIWIK["location"] if defined?(PIWIK) -else - policy = SecureHeaders::OPT_OUT -end +csp_policy[:connect_src] << PIWIK["location"] if defined?(PIWIK) +csp_policy[:img_src] << PIWIK["location"] if defined?(PIWIK) +csp_policy[:script_src] << PIWIK["location"] if defined?(PIWIK) + +csp_policy[:img_src] << Settings.storage_url if Settings.key?(:storage_url) + +csp_policy[:report_uri] << Settings.csp_report_url if Settings.key?(:csp_report_url) + +cookie_policy = { + :httponly => { :only => ["_osm_session"] } +} SecureHeaders::Configuration.default do |config| - config.hsts = "max-age=0" - config.csp = SecureHeaders::OPT_OUT - config.csp_report_only = policy + config.hsts = SecureHeaders::OPT_OUT + config.referrer_policy = "strict-origin-when-cross-origin" + + if Settings.csp_enforce + config.csp = csp_policy + config.csp_report_only = SecureHeaders::OPT_OUT + elsif Settings.key?(:csp_report_url) + config.csp = SecureHeaders::OPT_OUT + config.csp_report_only = csp_policy + else + config.csp = SecureHeaders::OPT_OUT + config.csp_report_only = SecureHeaders::OPT_OUT + end + + config.cookies = cookie_policy end