Added initial generated version of CSP config (#1208)

ifmeorg · Oct 30, 2018 · 3ff7666 · 3ff7666
1 parent e8f171c
commit 3ff7666
Showing 1 changed file with 13 additions and 0 deletions.
diff --git a/config/content_security_policy.rb b/config/content_security_policy.rb
@@ -0,0 +1,13 @@
+Rails.application.config.content_security_policy do |policy|
+  policy.default_src :none
+  policy.connect_src :self
+  policy.style_src :unsafe_inline, :self
+  policy.font_src :self, "https://cdn.jsdelivr.net"
+  policy.img_src "https://maps.gstatic.com", "https://res.cloudinary.com"
+  policy.script_src 'self', "https://js.pusher.com/3.0.0/xhr.min.js",
+    "https://js.pusher.com/3.0/pusher.min.js",
+    "https://maps.googleapis.com/maps/api/js",
+    "https://maps.googleapis.com/maps-api-v3/api/js",
+    "https://maps.googleapis.com/maps/api/place/js"
+end
+