Module: ActionController::ContentSecurityPolicy::ClassMethods
Relationships & Source Files | |
Defined in: | actionpack/lib/action_controller/metal/content_security_policy.rb |
Instance Method Summary
-
#content_security_policy(enabled = true, **options, &block)
Overrides parts of the globally configured
Content-Security-Policy
header: -
#content_security_policy_report_only(report_only = true, **options)
Overrides the globally configured
Content-Security-Policy-Report-Only
header:
Instance Method Details
#content_security_policy(enabled = true, **options, &block)
Overrides parts of the globally configured Content-Security-Policy
header:
class PostsController < ApplicationController
content_security_policy do |policy|
policy.base_uri "https://www.example.com"
end
end
Options can be passed similar to before_action
. For example, pass only: :index
to override the header on the index action only:
class PostsController < ApplicationController
content_security_policy(only: :index) do |policy|
policy.default_src :self, :https
end
end
Pass false
to remove the Content-Security-Policy
header:
class PostsController < ApplicationController
content_security_policy false, only: :index
end
# File 'actionpack/lib/action_controller/metal/content_security_policy.rb', line 39
def content_security_policy(enabled = true, **, &block) before_action( ) do if block_given? policy = current_content_security_policy instance_exec(policy, &block) request.content_security_policy = policy end unless enabled request.content_security_policy = nil end end end
#content_security_policy_report_only(report_only = true, **options)
Overrides the globally configured Content-Security-Policy-Report-Only
header:
class PostsController < ApplicationController
content_security_policy_report_only only: :index
end
Pass false
to remove the Content-Security-Policy-Report-Only
header:
class PostsController < ApplicationController
content_security_policy_report_only false, only: :index
end
# File 'actionpack/lib/action_controller/metal/content_security_policy.rb', line 65
def content_security_policy_report_only(report_only = true, ** ) before_action( ) do request.content_security_policy_report_only = report_only end end