class Rack::ContentSecurityPolicy

Constants

CSP_HEADER
CSP_REPORT_ONLY_HEADER
NO_ARG_DIRECTIVES
VERSION

Public Class Methods

[]=(name, value) click to toggle source
# File lib/rack/content_security_policy.rb, line 88
def self.[]=(name, value)
  @directives[name] = value
end
configure() { |self| ... } click to toggle source
# File lib/rack/content_security_policy.rb, line 82
def self.configure
  @directives ||= {}
  yield(self)
end
directives() click to toggle source
# File lib/rack/content_security_policy.rb, line 77
def self.directives
  @directives
end
new(app, directives: {}, report_only: false) click to toggle source
# File lib/rack/content_security_policy.rb, line 16
def initialize(app, directives: {}, report_only: false)
  @app = app

  class_dirs = Rack::ContentSecurityPolicy.directives
  if directives.empty? && class_dirs.empty?
    raise ArgumentError, 'no directives provided'
  end
  @directives = class_dirs.merge(directives)

  class_report_only = Rack::ContentSecurityPolicy.report_only
  @report_only = report_only || class_report_only ? true : false
end
report_only() click to toggle source
# File lib/rack/content_security_policy.rb, line 72
def self.report_only
  @report_only
end
report_only=(ro) click to toggle source
# File lib/rack/content_security_policy.rb, line 67
def self.report_only=(ro)
  @report_only = ro
end

Public Instance Methods

_call(env) click to toggle source
# File lib/rack/content_security_policy.rb, line 45
def _call(env)
  status, headers, response = @app.call(env)

  directives = @directives.sort.map do |d|
    if NO_ARG_DIRECTIVES.include?(d[0])
      d[0]
    else
      "#{d[0]} #{d[1]}"
    end
  end.join('; ')

  csp_hdr = @report_only ? CSP_REPORT_ONLY_HEADER : CSP_HEADER
  headers[csp_hdr] = directives

  [status, headers, response]
end
call(env) click to toggle source
# File lib/rack/content_security_policy.rb, line 40
def call(env)
  dup._call(env)
end
directives() click to toggle source
# File lib/rack/content_security_policy.rb, line 35
def directives
  @directives
end
report_only() click to toggle source
# File lib/rack/content_security_policy.rb, line 30
def report_only
  @report_only
end