Module: ProductTours::ContentSecurityPolicy

Defined in:: lib/product_tours/content_security_policy.rb

Constant Summary collapse

FRAME_SOURCES =

%w[
  https://www.youtube-nocookie.com
  https://player.vimeo.com
  https://www.loom.com
  https://www.tella.tv
  https://embed.voomly.com
].freeze

Class Method Summary collapse

.apply!(policy) ⇒ Object

Class Method Details

.apply!(policy) ⇒ `Object`

# File 'lib/product_tours/content_security_policy.rb', line 15

def apply!(policy)
  return unless policy

  sources = Array(policy.directives['frame-src'])
  sources = Array(policy.directives['default-src']) if sources.empty?
  sources = sources.reject { |source| source == "'none'" }
  policy.frame_src(*(sources + FRAME_SOURCES).uniq)
end