Class: ActionDispatch::ContentSecurityPolicy::Middleware

Inherits:
Object
  • Object
show all
Defined in:
lib/action_dispatch/http/content_security_policy.rb

Constant Summary collapse

CONTENT_TYPE = 
"Content-Type".freeze
POLICY = 
"Content-Security-Policy".freeze
POLICY_REPORT_ONLY = 
"Content-Security-Policy-Report-Only".freeze

Instance Method Summary collapse

Constructor Details

#initialize(app) ⇒ Middleware

Returns a new instance of Middleware.



12
13
14
 
# File 'lib/action_dispatch/http/content_security_policy.rb', line 12

def initialize(app)
  @app = app
end

Instance Method Details

#call(env) ⇒ Object 



16
17
18
19
20
21
22
23
24
25
26
27
28
29
 
# File 'lib/action_dispatch/http/content_security_policy.rb', line 16

def call(env)
  request = ActionDispatch::Request.new env
  _, headers, _ = response = @app.call(env)

  return response if policy_present?(headers)

  if policy = request.content_security_policy
    nonce = request.content_security_policy_nonce
    context = request.controller_instance || request
    headers[header_name(request)] = policy.build(context, nonce)
  end

  response
end