From 0c6783816e0a7a8acad922296d3eb8cc454fb981 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Sat, 18 Jul 2026 16:30:31 +0200 Subject: Emit a report-only Content-Security-Policy with nonced inline scripts - dark-mode restore now travels nonced, the admin constants likewise - AUTH_TOKEN deleted in favour of the csrf meta tag - new report collector at /csp_reports --- app/controllers/csp_reports_controller.rb | 10 ++++++++++ app/views/layouts/admin.html.erb | 5 ++--- app/views/layouts/application.html.erb | 10 +++++----- 3 files changed, 17 insertions(+), 8 deletions(-) create mode 100644 app/controllers/csp_reports_controller.rb (limited to 'app') diff --git a/app/controllers/csp_reports_controller.rb b/app/controllers/csp_reports_controller.rb new file mode 100644 index 0000000..08cbc98 --- /dev/null +++ b/app/controllers/csp_reports_controller.rb @@ -0,0 +1,10 @@ +class CspReportsController < ApplicationController + # Browsers POST application/csp-report with no CSRF token, no session. + skip_before_action :verify_authenticity_token + + def create + report = request.body.read(8192) + Rails.logger.warn("CSP violation: #{report}") if report.present? + head :no_content + end +end diff --git a/app/views/layouts/admin.html.erb b/app/views/layouts/admin.html.erb index 0856a0f..e220beb 100644 --- a/app/views/layouts/admin.html.erb +++ b/app/views/layouts/admin.html.erb @@ -7,19 +7,18 @@ <%= csrf_meta_tags %> <%= "#{params[:controller]} | #{params[:action]}" %> - <%= javascript_tag "var AUTH_TOKEN = #{form_authenticity_token.inspect};" if protect_against_forgery? %> <%= javascript_include_tag 'admin_bundle' %> <%= tinymce_assets %> - + <% end %> diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb index d7681af..ca867ab 100644 --- a/app/views/layouts/application.html.erb +++ b/app/views/layouts/application.html.erb @@ -18,12 +18,12 @@ <%= auto_discovery_link_tag(:atom, '/rss/updates.xml', title: "ATOM") %> <%= auto_discovery_link_tag(:rss, '/rss/updates.rdf', title: "RSS") %> - + }); + <% end %> -- cgit v1.3