3 Commits

Include renames

Author	SHA1	Message	Date
David Taylor	19814c5e81	FIX: Allow CSP to work correctly for non-default hostnames/schemes (#9180) ... - Define the CSP based on the requested domain / scheme (respecting force_https) - Update EnforceHostname middleware to allow secondary domains, add specs - Add URL scheme to anon cache key so that CSP headers are cached correctly	2020-03-19 19:54:42 +00:00
Penar Musaraj	e11c6ffa89	FEATURE: allow extending CSP base-uri and object-src ... Plus, ensure :none is stripped, it cannot be combined with other sources	2019-01-09 15:34:14 -05:00
Kyle Zhao	488fba3c5f	FEATURE: allow plugins and themes to extend the default CSP (#6704) ... * FEATURE: allow plugins and themes to extend the default CSP For plugins: ``` extend_content_security_policy( script_src: ['https://domain.com/script.js', 'https://your-cdn.com/'], style_src: ['https://domain.com/style.css'] ) ``` For themes and components: ``` extend_content_security_policy: type: list default: "script_src:https://domain.com/|style_src:https://domain.com" ``` * clear CSP base url before each test we have a test that stubs `Rails.env.development?` to true * Only allow extending directives that core includes, for now	2018-11-30 09:51:45 -05:00