Class: ActionDispatch::ContentSecurityPolicy::Middleware

Inherits:
Object
  • Object
show all
Defined in:
lib/action_dispatch/http/content_security_policy.rb

Instance Method Summary collapse

Constructor Details

#initialize(app) ⇒ Middleware

Returns a new instance of Middleware.



28
29
30
 
# File 'lib/action_dispatch/http/content_security_policy.rb', line 28

def initialize(app)
  @app = app
end

Instance Method Details

#call(env) ⇒ Object 



32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
 
# File 'lib/action_dispatch/http/content_security_policy.rb', line 32

def call(env)
  status, headers, _ = response = @app.call(env)

  # Returning CSP headers with a 304 Not Modified is harmful, since nonces in the new
  # CSP headers might not match nonces in the cached HTML.
  return response if status == 304

  return response if policy_present?(headers)

  request = ActionDispatch::Request.new env

  if policy = request.content_security_policy
    nonce = request.content_security_policy_nonce
    nonce_directives = request.content_security_policy_nonce_directives
    context = request.controller_instance || request
    headers[header_name(request)] = policy.build(context, nonce, nonce_directives)
  end

  response
end