Log CSP violations to their own file instead of relying on Rails.logger

2 files changed, 6 insertions, 2 deletions

diff --git a/app/controllers/csp_reports_controller.rb b/app/controllers/csp_reports_controller.rb
index a8f8edb..5a3b55e 100644
--- a/app/controllers/csp_reports_controller.rb
+++ b/app/controllers/csp_reports_controller.rb
@@ -12,9 +12,9 @@ class CspReportsController < ApplicationController
     if report
       directive = report["effective-directive"] || report["violated-directive"]
       at = (URI.parse(report["document-uri"]).path rescue "unparsed")
-      Rails.logger.warn("CSP violation: #{directive} blocked=#{report['blocked-uri']} at=#{at}")
+      CSP_LOGGER.warn("CSP violation: #{directive} blocked=#{report['blocked-uri']} at=#{at}")
     else
-      Rails.logger.warn("CSP violation: unparseable report (#{raw.to_s.bytesize} bytes)")
+      CSP_LOGGER.warn("CSP violation: unparseable report (#{raw.to_s.bytesize} bytes)")
     end
 
     head :no_content
diff --git a/config/initializers/csp_log.rb b/config/initializers/csp_log.rb
new file mode 100644
index 0000000..1dde9c4
--- /dev/null
+++ b/config/initializers/csp_log.rb
@@ -0,0 +1,4 @@
+# CSP violation reports get their own file, independent of config.logger.
+CSP_LOGGER = Rails.env.production? ?
+  ActiveSupport::Logger.new(Rails.root.join("log", "csp_violations.log")) :
+  Rails.logger