SecureHeaders::ContentSecurityPolicy

Attributes

browser[R]
experimental[R]
report_uri[R]
request_uri[R]
ssl_request[R]
ssl_request?[R]

Public Class Methods

new(config=nil, options={}) click to toggle source

options param contains :experimental use experimental block for config :ssl_request used to determine if http_additions should be used :request_uri used to determine if firefox should send the report directly or use the forwarding endpoint :ua the user agent (or just use Firefox/Chrome/MSIE/etc)

:report used to determine what :ssl_request, :ua, and :request_uri are set to

# File lib/secure_headers/headers/content_security_policy.rb, line 31
def initialize(config=nil, options={})
  @experimental = !!options.delete(:experimental)
  @controller = options.delete(:controller)

  if options[:request]
    parse_request(options[:request])
  else
    @ua = options[:ua]
    # fails open, assumes http. Bad idea? Will always include http additions.
    # could also fail if not supplied.
    @ssl_request = !!options.delete(:ssl)
    # a nil value here means we always assume we are not on the same host,
    # which causes all FF csp reports to go through the forwarder
    @request_uri = options.delete(:request_uri)
  end

  configure(config) if config
end

Public Instance Methods

configure(config) click to toggle source
# File lib/secure_headers/headers/content_security_policy.rb, line 54
def configure(config)
  @config = config.dup

  experimental_config = @config.delete(:experimental)
  if @experimental && experimental_config
    @config[:http_additions] = experimental_config[:http_additions]
    @config.merge!(experimental_config)
  end

  # these values don't support lambdas because this needs to be rewritten
  @http_additions = @config.delete(:http_additions)
  @app_name = @config.delete(:app_name)

  normalize_csp_options

  META.each do |meta|
    self.send("#{meta}=", @config.delete(meta))
  end

  @enforce = !!@config.delete(:enforce)
  @tag_report_uri = @config.delete(:tag_report_uri)

  normalize_reporting_endpoint
  fill_directives unless disable_fill_missing?
end
name() click to toggle source
# File lib/secure_headers/headers/content_security_policy.rb, line 80
def name
  base = STANDARD_HEADER_NAME
  if !@enforce || experimental
    base += "-Report-Only"
  end
  base
end
nonce() click to toggle source
# File lib/secure_headers/headers/content_security_policy.rb, line 50
def nonce
  @nonce ||= SecureRandom.base64(32).chomp
end
value() click to toggle source
# File lib/secure_headers/headers/content_security_policy.rb, line 88
def value
  return @config if @config.is_a?(String)
  if @config
    build_value
  else
    DEFAULT_CSP_HEADER
  end
end

[Validate]

Generated with the Darkfish Rdoc Generator 2.