1 files changed, 22 insertions, 0 deletions

diff --git a/app/controllers/csp_reports_controller.rb b/app/controllers/csp_reports_controller.rb
new file mode 100644
index 0000000..a8f8edb
--- /dev/null
+++ b/app/controllers/csp_reports_controller.rb
@@ -0,0 +1,22 @@
+class CspReportsController < ApplicationController
+  # Browsers POST application/csp-report with no CSRF token, no session.
+  skip_before_action :verify_authenticity_token
+
+  def create
+    request.body.rewind if request.body.respond_to?(:rewind)
+    raw = request.body.read(8192)
+    raw = request.raw_post if raw.blank?
+
+    report = (JSON.parse(raw)["csp-report"] rescue nil)
+
+    if report
+      directive = report["effective-directive"] || report["violated-directive"]
+      at = (URI.parse(report["document-uri"]).path rescue "unparsed")
+      Rails.logger.warn("CSP violation: #{directive} blocked=#{report['blocked-uri']} at=#{at}")
+    else
+      Rails.logger.warn("CSP violation: unparseable report (#{raw.to_s.bytesize} bytes)")
+    end
+
+    head :no_content
+  end
+end