config/initializers/security_headers.rb

	security_headers.rb revision 450c425d47cb4ff346c009bf6193057cee85fcc6
4a39339aa23281394032fee570325e5197c828aaSascha Graef::SecureHeaders::Configuration.default do |config|
7152ae731eaa6fb83bc8147a463fae3a342d6360Sascha Graef  config.hsts                   = 'max-age=99; includeSubdomains'
ee5342a8882c2fc7631fcffb5497e6597747887cTim Reddehase  config.x_frame_options        = 'DENY'
7152ae731eaa6fb83bc8147a463fae3a342d6360Sascha Graef  config.x_content_type_options = 'nosniff'
fa1ca6b2e01521466ef4739908beda10537ea61bSascha Graef  config.x_xss_protection       = '1; mode=block'
7152ae731eaa6fb83bc8147a463fae3a342d6360Sascha Graef  # By default, load resources only from own origin.
4a39339aa23281394032fee570325e5197c828aaSascha Graef  # For CSS, allow styles from style elements and attributes for GWT.
  config.csp                    = {
    default_src: %w('self'),
    style_src:   %w('self' 'unsafe-inline'),
    script_src: %w('self'),
    frame_src: %w('self'),
    img_src: %w('self'),
    connect_src: %w('self'),
    font_src: %w('self'),
    media_src: %w('self'),
    object_src: %w('self'),
    child_src: %w('self'),
  }
end