I am trying to create a vary basic .rb plugin (based on the now obsolete in chrome) discourse-allowall which will merge the CSP header to the default ones but cant get it to work. The below does not seem to do it. Rails.application.config.action_dispatch.default_headers.merge!({'Content-Security-Po…

My syntax was off and this is working fine now. Correct syntax is like: Rails.application.config.action_dispatch.default_headers.merge!({'Content-Security-Policy' => "frame-ancestors mylocal.com.localhost"})

Support for this was added in core: Mitigate XSS Attacks with Content Security Policy - #37 by Falco

Adding CSP header

개발

Falco (Falco) 3월 23, 2021, 12:17오전 3

이 기능에 대한 지원은 코어에 추가되었습니다: Mitigate XSS Attacks with Content Security Policy - #37 by Falco

글		댓글	조회수
Add own CSP headers Product Support	4	576	5월 17, 2023
Adding HTTP Headers to Plugin in Development Development	3	941	5월 18, 2020
And invalid response header is being set from embed controller Product Support	3	829	3월 23, 2021
CSP Frame Ancestors enabled by default Announcements	3	1800	8월 5, 2021
Allowed iframes whitelist not working - 'x-frame-options: SAMEORIGIN' Product Support	3	983	6월 30, 2022

Adding CSP header

Related topics