Class: Abqari::HeadersFile

Inherits:
Object
  • Object
show all
Defined in:
lib/abqari/headers_file.rb

Constant Summary collapse

BASE_HEADERS =

The CSP is built per-build based on which optional features are configured (Plausible analytics, etc.). The base policy is strict: 'self' only, with the inline theme-bootstrap script pinned by SHA256 so we don't need 'unsafe-inline'. Each opt-in feature extends the policy minimally — Plausible adds plausible.io to script-src and connect-src plus the inline init script's hash, and that's it.

To allow an origin the engine doesn't model, add it to csp: in config/site.yml — additive, so everything computed here survives. media: does the same for off-origin audio / video.

Override the whole thing by setting headers: in config/site.yml — that disables this dynamic build entirely and ships your structure verbatim. Reach for it only when you need to weaken a hardening directive or use a non-http scheme; csp: covers adding origins without losing the pinned script hashes.

{
  'X-Content-Type-Options'    => 'nosniff',
  'Referrer-Policy'           => 'strict-origin-when-cross-origin',
  'Permissions-Policy'        => 'camera=(), microphone=(), geolocation=(), interest-cohort=()',
  'Strict-Transport-Security' => 'max-age=31536000; includeSubDomains'
}.freeze

Instance Method Summary collapse

Constructor Details

#initialize(site) ⇒ HeadersFile

Returns a new instance of HeadersFile.



33
34
35
 
# File 'lib/abqari/headers_file.rb', line 33

def initialize(site)
  @site = site
end

Instance Method Details

#write ⇒ Object 



37
38
39
 
# File 'lib/abqari/headers_file.rb', line 37

def write
  File.write(File.join(@site.output_dir, '_headers'), build)
end