I am trying to create a vary basic .rb plugin (based on the now obsolete in chrome) discourse-allowall which will merge the CSP header to the default ones but cant get it to work. The below does not seem to do it. Rails.application.config.action_dispatch.default_headers.merge!({'Content-Security-Po…

My syntax was off and this is working fine now. Correct syntax is like: Rails.application.config.action_dispatch.default_headers.merge!({'Content-Security-Policy' => "frame-ancestors mylocal.com.localhost"})

Support for this was added in core: Mitigate XSS Attacks with Content Security Policy - #37 by Falco

添加 CSP 标头

开发

Falco (Falco) 2021年三月23日 00:17 3

对此的支持已添加到核心：Mitigate XSS Attacks with Content Security Policy - #37 by Falco

話題		回覆	觀看
Add own CSP headers Support	4	515	2023年五月17日
Adding HTTP Headers to Plugin in Development Development	3	923	2020年五月18日
And invalid response header is being set from embed controller Support	3	802	2021年三月23日
CSP Frame Ancestors enabled by default Announcements	3	1783	2021年八月5日
Allowed iframes whitelist not working - 'x-frame-options: SAMEORIGIN' Support	3	958	2022年六月30日

添加 CSP 标头

相關主題