From 584ac67c103c6b2ac17396cc2b65c35bede13403 Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Thu, 17 May 2018 19:10:39 +0100 Subject: [PATCH] Configure manifest-src and worker-src in security policy --- config/initializers/secure_headers.rb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/config/initializers/secure_headers.rb b/config/initializers/secure_headers.rb index ba9aa496f..cd6979bee 100644 --- a/config/initializers/secure_headers.rb +++ b/config/initializers/secure_headers.rb @@ -9,11 +9,13 @@ if defined?(CSP_REPORT_URL) :frame_ancestors => %w['self'], :frame_src => %w['self'], :img_src => %w['self' data: www.gravatar.com *.wp.com *.tile.openstreetmap.org *.tile.thunderforest.com *.openstreetmap.fr], + :manifest_src => %w['none'], :media_src => %w['none'], :object_src => %w['self'], :plugin_types => %w[], :script_src => %w['self'], :style_src => %w['self'], + :worker_src => %w['none'], :report_uri => [CSP_REPORT_URL] } -- 2.39.5