Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Generate content security policy for non-HTML responses #44635

Merged
merged 2 commits into from Mar 8, 2022
Merged

Generate content security policy for non-HTML responses #44635

merged 2 commits into from Mar 8, 2022

Commits on Mar 8, 2022

  1. Generate content security policy for non-HTML responses 

    One feature of the content security policy DSL, though undocumented,
is that it will not generate headers for non-HTML responses, even if a
configuration is explicitly provided. While it may not seem obvious
that anyone would want to send this header in an API response, Mozilla
Observatory, for instance, recommends the following for API responses:

`Content-Security-Policy: default-src 'none'; frame-ancestors 'none'`

(source: https://observatory.mozilla.org/faq/)

The Secure Headers gem also makes recommendations about the content
security policy for API responses: https://github.com/github/secure_headers#api-configurations

As such, this removes the HTML guard clause from the
`ContentSecurityPolicy` middleware.
    @imtayadeway
    imtayadeway committed Mar 8, 2022
    Copy the full SHA
    803f875 View commit details
    Browse the repository at this point in the history

  2. Update actionpack/CHANGELOG.md 

    Co-authored-by: Alex Ghiculescu <alex@tanda.co>
    @imtayadeway @ghiculescu
    imtayadeway and ghiculescu committed Mar 8, 2022
    Copy the full SHA
    acf7e0d View commit details
    Browse the repository at this point in the history