CODEWITHSUNDEEP
rubyruby-on-rails-5content-security-policy
Kevin
Kevin

Reputation: 15964

How do I programmatically set a content_security_policy?

I'm configuring the Content Security Policy for our Rails 5.2 app. I need to whitelist some domains in our CSP. I'd like to put the list of domains elsewhere so I can reference them in other places in the application, then generate the CSP headers programmatically from that list.

Looking at the source code for the Content Security Policy configuration mechanisms in Rails 5, it looks like there's some magic metaprogramming going on, so it's not clear to me how to accomplish what I need to do. It looks like the functions I need to call to set headers might be picky about how exactly they want to be called. In particular, it's not clear to me if I can pass them arrays or safely call them multiple times, or if they do some metaprogramming magic that only works if the domains are passed in as individual function arguments.

Can I pass in an array to the header I want to set, like this?

whitelisted_domains = ['https://example.com', 'self']

Rails.application.configure do
  config.content_security_policy do |csp|
    csp.child_src whitelisted_domains
  end
end

Or can I call the same function multiple times, like this?

whitelisted_domains = ['https://example.com', 'self']

Rails.application.configure do
  config.content_security_policy do |csp|
    whitelisted_domains.each {|domain| csp.child_src domain}
  end
end

If neither of those will work, what's the best way of accomplishing what I want to do?

Upvotes: 1

Views: 1097

Answers (1)

Frederik Spang
Frederik Spang

Reputation: 3454

From what I can tell from sourcecode and documentation, it takes an array. From the edgeguides at rails, posting following

Rails.application.config.content_security_policy do |policy|
  policy.default_src :self, :https
  ...
end

and the sourcecode, using *sources as param; it believe it takes any number of arguments, meaning you could do something along the lines of; 

whitelisted_domains = ['https://example.com', 'self']

Rails.application.configure do
  config.content_security_policy do |csp|
    csp.child_src(*whitelisted_domains)
  end
end

https://blog.sqreen.io/integrating-content-security-policy-into-your-rails-applications-4f883eed8f45/

https://edgeguides.rubyonrails.org/security.html#content-security-policy

Sourcecode of define_method for each directive https://github.com/rails/rails/blob/master/actionpack/lib/action_dispatch/http/content_security_policy.rb#L151

(note: None of this has been tested in a Rails app, simple looking guides and source code of Rails)

Upvotes: 2

Related Questions