X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/e9f62a8c30832e0533dce0ccd691b6c89e98ae30..be7248bace3b5dcd4498df75d09a70fff75a86e5:/config/initializers/secure_headers.rb diff --git a/config/initializers/secure_headers.rb b/config/initializers/secure_headers.rb index 53ab76808..778b5b827 100644 --- a/config/initializers/secure_headers.rb +++ b/config/initializers/secure_headers.rb @@ -7,7 +7,7 @@ csp_policy = { :form_action => %w['self'], :frame_ancestors => %w['self'], :frame_src => %w['self'], - :img_src => %w['self' data: www.gravatar.com *.wp.com tile.openstreetmap.org *.tile.openstreetmap.org *.tile.thunderforest.com tileserver.memomaps.de *.openstreetmap.fr], + :img_src => %w['self' data: www.gravatar.com *.wp.com tile.openstreetmap.org *.tile.openstreetmap.org *.tile.thunderforest.com tileserver.memomaps.de tile.tracestrack.com *.openstreetmap.fr], :manifest_src => %w['self'], :media_src => %w['none'], :object_src => %w['self'], @@ -28,7 +28,7 @@ csp_policy[:img_src] << Settings.trace_image_storage_url if Settings.key?(:trace csp_policy[:report_uri] << Settings.csp_report_url if Settings.key?(:csp_report_url) cookie_policy = { - :httponly => { :only => ["_osm_session"] } + :httponly => { :only => %w[_osm_session _osm_totp_token] } } SecureHeaders::Configuration.default do |config|