From 0c6783816e0a7a8acad922296d3eb8cc454fb981 Mon Sep 17 00:00:00 2001
From: erdgeist <erdgeist@erdgeist.org>
Date: Sat, 18 Jul 2026 16:30:31 +0200
Subject: Emit a report-only Content-Security-Policy with nonced inline scripts

- dark-mode restore now travels nonced, the admin constants likewise
- AUTH_TOKEN deleted in favour of the csrf meta tag
- new report collector at /csp_reports
---
 app/controllers/csp_reports_controller.rb | 10 ++++++++++
 1 file changed, 10 insertions(+)
 create mode 100644 app/controllers/csp_reports_controller.rb

(limited to 'app/controllers/csp_reports_controller.rb')

diff --git a/app/controllers/csp_reports_controller.rb b/app/controllers/csp_reports_controller.rb
new file mode 100644
index 0000000..08cbc98
--- /dev/null
+++ b/app/controllers/csp_reports_controller.rb
@@ -0,0 +1,10 @@
+class CspReportsController < ApplicationController
+  # Browsers POST application/csp-report with no CSRF token, no session.
+  skip_before_action :verify_authenticity_token
+
+  def create
+    report = request.body.read(8192)
+    Rails.logger.warn("CSP violation: #{report}") if report.present?
+    head :no_content
+  end
+end
-- 
cgit v1.3