Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add new APIs to customize content security policy for non-HTML responses #39398

Open
wants to merge 12 commits into
base: main
Choose a base branch
from
+532 −149
Open

Add new APIs to customize content security policy for non-HTML responses #39398

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
05344fc
Generate content security policy for non-HTML responses
imtayadeway Jun 16, 2020
b840a7d
[wip] failing test for html
imtayadeway Jul 2, 2020
2aa6585
Add content_security_policy.html
imtayadeway Jul 6, 2020
2ea33e8
Add some tests for JSON, slime it for now
imtayadeway Jul 6, 2020
12a0048
Approximating a solution
imtayadeway Jul 6, 2020
0731722
Parse the content_type
imtayadeway Jul 6, 2020
418fa0b
Some metaprogramming
imtayadeway Jul 8, 2020
0105939
Refactory
imtayadeway Jul 9, 2020
9a7c513
...and we're green
imtayadeway Jul 9, 2020
d14792f
sort n merge
imtayadeway Jul 9, 2020
8f54f18
Warn on no policy
imtayadeway Jul 22, 2020
88c02f9
Fix default middleware tests
imtayadeway Jul 22, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
3 changes: 3 additions & 0 deletions actionpack/CHANGELOG.md
View file
Open in desktop
@@ -1,3 +1,6 @@
* Allow Content Security Policy DSL to generate for API responses.
*Tim Wade*
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's describe this a bit more. The summary in the pull request is great! We'll now send CSP headers with all responses, not just HTML, to protect API responses that could be loaded in a browser.


* When multiple domains are specified for a cookie, a domain will now be
jeremy marked this conversation as resolved.
Show resolved Hide resolved
chosen only if it is equal to or is a superdomain of the request host.

Expand Down