I am trying to create a vary basic .rb plugin (based on the now obsolete in chrome) discourse-allowall which will merge the CSP header to the default ones but cant get it to work. The below does not seem to do it. Rails.application.config.action_dispatch.default_headers.merge!({'Content-Security-Po…

My syntax was off and this is working fine now. Correct syntax is like: Rails.application.config.action_dispatch.default_headers.merge!({'Content-Security-Policy' => "frame-ancestors mylocal.com.localhost"})

Support for this was added in core: Mitigate XSS Attacks with Content Security Policy - #37 by Falco

CSPヘッダーの追加

開発

Falco (Falco) 2021 年 3 月 23 日午前 12:17 3

この機能のコアへのサポートは以下で追加されました: Mitigate XSS Attacks with Content Security Policy - #37 by Falco

トピック		返信	表示
Add own CSP headers Support	5	469	2023 年 6 月 16 日
Adding HTTP Headers to Plugin in Development Development	3	884	2020 年 5 月 18 日
And invalid response header is being set from embed controller Support	4	751	2021 年 3 月 27 日
CSP Frame Ancestors enabled by default Announcements	4	1704	2023 年 12 月 20 日
Allowed iframes whitelist not working - 'x-frame-options: SAMEORIGIN' Support	4	910	2022 年 6 月 30 日

CSPヘッダーの追加

関連トピック