options param contains :experimental use experimental block for config :ssl_request used to determine if http_additions should be used :request_uri used to determine if firefox should send the report directly or use the forwarding endpoint :ua the user agent (or just use Firefox/Chrome/MSIE/etc)
:report used to determine what :ssl_request, :ua, and :request_uri are set to
# File lib/secure_headers/headers/content_security_policy.rb, line 31 def initialize(config=nil, options={}) @experimental = !!options.delete(:experimental) @controller = options.delete(:controller) if options[:request] parse_request(options[:request]) else @ua = options[:ua] # fails open, assumes http. Bad idea? Will always include http additions. # could also fail if not supplied. @ssl_request = !!options.delete(:ssl) # a nil value here means we always assume we are not on the same host, # which causes all FF csp reports to go through the forwarder @request_uri = options.delete(:request_uri) end configure(config) if config end
# File lib/secure_headers/headers/content_security_policy.rb, line 54 def configure(config) @config = config.dup experimental_config = @config.delete(:experimental) if @experimental && experimental_config @config[:http_additions] = experimental_config[:http_additions] @config.merge!(experimental_config) end # these values don't support lambdas because this needs to be rewritten @http_additions = @config.delete(:http_additions) @app_name = @config.delete(:app_name) normalize_csp_options META.each do |meta| self.send("#{meta}=", @config.delete(meta)) end @enforce = !!@config.delete(:enforce) @tag_report_uri = @config.delete(:tag_report_uri) normalize_reporting_endpoint fill_directives unless disable_fill_missing? end
# File lib/secure_headers/headers/content_security_policy.rb, line 80 def name base = STANDARD_HEADER_NAME if !@enforce || experimental base += "-Report-Only" end base end
Generated with the Darkfish Rdoc Generator 2.