From e0c2d7a066793683a911bee7f7210d80eb6b2055 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Sun, 19 Jul 2026 16:16:43 +0200 Subject: Log CSP violations to their own file instead of relying on Rails.logger --- app/controllers/csp_reports_controller.rb | 4 ++-- config/initializers/csp_log.rb | 4 ++++ 2 files changed, 6 insertions(+), 2 deletions(-) create mode 100644 config/initializers/csp_log.rb diff --git a/app/controllers/csp_reports_controller.rb b/app/controllers/csp_reports_controller.rb index a8f8edb..5a3b55e 100644 --- a/app/controllers/csp_reports_controller.rb +++ b/app/controllers/csp_reports_controller.rb @@ -12,9 +12,9 @@ class CspReportsController < ApplicationController if report directive = report["effective-directive"] || report["violated-directive"] at = (URI.parse(report["document-uri"]).path rescue "unparsed") - Rails.logger.warn("CSP violation: #{directive} blocked=#{report['blocked-uri']} at=#{at}") + CSP_LOGGER.warn("CSP violation: #{directive} blocked=#{report['blocked-uri']} at=#{at}") else - Rails.logger.warn("CSP violation: unparseable report (#{raw.to_s.bytesize} bytes)") + CSP_LOGGER.warn("CSP violation: unparseable report (#{raw.to_s.bytesize} bytes)") end head :no_content diff --git a/config/initializers/csp_log.rb b/config/initializers/csp_log.rb new file mode 100644 index 0000000..1dde9c4 --- /dev/null +++ b/config/initializers/csp_log.rb @@ -0,0 +1,4 @@ +# CSP violation reports get their own file, independent of config.logger. +CSP_LOGGER = Rails.env.production? ? + ActiveSupport::Logger.new(Rails.root.join("log", "csp_violations.log")) : + Rails.logger -- cgit v1.3