Log CSP violations to their own file instead of relying on Rails.logger

1 files changed, 4 insertions, 0 deletions

diff --git a/config/initializers/csp_log.rb b/config/initializers/csp_log.rb
new file mode 100644
index 0000000..1dde9c4
--- /dev/null
+++ b/config/initializers/csp_log.rb
@@ -0,0 +1,4 @@
+# CSP violation reports get their own file, independent of config.logger.
+CSP_LOGGER = Rails.env.production? ?
+  ActiveSupport::Logger.new(Rails.root.join("log", "csp_violations.log")) :
+  Rails.logger