From 959c1ad610416c98a44114d7d3ec6b5ed0e67740 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Lecour?= Date: Thu, 3 Sep 2020 22:46:37 +0200 Subject: [PATCH] Don't use nonce in CSP in development mode --- config/initializers/content_security_policy.rb | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb index f38a4ce..4b9f3da 100644 --- a/config/initializers/content_security_policy.rb +++ b/config/initializers/content_security_policy.rb @@ -11,19 +11,23 @@ Rails.application.config.content_security_policy do |policy| policy.object_src :none policy.script_src :self, :https if Rails.env.development? - policy.style_src :self, :https, :blob + policy.style_src :self, :https, :blob, :unsafe_inline else policy.style_src :self, :https end # If you are using webpack-dev-server then specify webpack-dev-server host - policy.connect_src :self, :https, "http://localhost:3035", "ws://localhost:3035" if Rails.env.development? + if Rails.env.development? + policy.connect_src :self, :https, "http://localhost:3035", "ws://localhost:3035" + end # Specify URI for violation reports # policy.report_uri "/csp-violation-report-endpoint" end # If you are using UJS then enable automatic nonce generation -Rails.application.config.content_security_policy_nonce_generator = -> request { SecureRandom.base64(16) } +unless Rails.env.development? + Rails.application.config.content_security_policy_nonce_generator = -> request { SecureRandom.base64(16) } +end # Set the nonce only to specific directives # Rails.application.config.content_security_policy_nonce_directives = %w(script-src)