Adding CSP header

Dev
1

I am trying to create a vary basic .rb plugin (based on the now obsolete in chrome) discourse-allowallwhich will merge the CSP header to the default ones but cant get it to work.

The below does not seem to do it.

Rails.application.config.action_dispatch.default_headers.merge!({'Content-Security-Policy' => "frame-ancestors 'http://mylocal.com.localhost'"})

I literally have 0 experience with ruby so need to know:

  1. If thats possible
  2. The correct syntax for defining the above header and merging it with the default ones

End goal is to make my discourse site frameable by 2 specific domains

2

My syntax was off and this is working fine now. Correct syntax is like:

Rails.application.config.action_dispatch.default_headers.merge!({'Content-Security-Policy' => "frame-ancestors mylocal.com.localhost"})

2 Likes
3

Support for this was added in core: Mitigate XSS Attacks with Content Security Policy - #37 by Falco

1 Like