From ce6d18334f6adfa6e2407eb3b0edf2c192a48aa1 Mon Sep 17 00:00:00 2001 From: kavyanekkalapu Date: Thu, 14 Apr 2022 15:05:29 -0400 Subject: [PATCH] update csp configuraton --- config/initializers/secure_headers.rb | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/config/initializers/secure_headers.rb b/config/initializers/secure_headers.rb index 6725a1edad5..15ca44a72bb 100644 --- a/config/initializers/secure_headers.rb +++ b/config/initializers/secure_headers.rb @@ -12,13 +12,15 @@ # X-Permitted-Cross-Domain-Policies config.x_xss_protection = "1; mode=block" # Content-Security-Policy + # Need google fonts in fonts_src for https://fonts.googleapis.com/css?family=IBM+Plex+Sans+Condensed%7CIBM+Plex+Sans:400,600&display=swap (For carbon-charts download) config.csp = { :report_only => false, :default_src => ["'self'"], :frame_src => ["'self'"], - :font_src => ["'self'", 'https://fonts.gstatic.com'], + :font_src => ["'self'", 'https://fonts.gstatic.com', "https://fonts.googleapis.com"], + :img_src => ["'self'", "data:"], :connect_src => ["'self'"], - :style_src => ["'unsafe-inline'", "'self'"], + :style_src => ["'unsafe-inline'", "'self'", "https://fonts.googleapis.com", "https://fonts.gstatic.com"], :script_src => ["'unsafe-eval'", "'unsafe-inline'", "'self'"], :report_uri => ["/dashboard/csp_report"] }