8596f1539f
The config.file_watcher option still exists but it's no longer included in the default environtment file. Since we don't use it, we're removing it. The config.assets.assets.debug option is no longer true by default [1], so it isn't included anymore. The config.active_support.deprecation option is now omitted on production in favor of config.active_support.report_deprecations, which is false by default. I think it's OK to keep it this way, since we check deprecations in the development and test environments but never on production environments. As mentioned in the Rails upgrade guide, sprockets-rails is no longer a rails dependency and we need to explicitly include it in our Gemfile. The behavior of queries trying to find an invalid enum value has changed [2], so we're updating the tests accordingly. The `favicon_link_tag` method has removed the deprecated `shortcut` link type [3], so we're updating the tests accordingly. The method `raw_filter` in ActiveSupport callbacks has been renamed to `filter` [4], so we're updating the code accordingly. [1] https://github.com/rails/rails/commit/adec7e7ba87e3 [2] https://github.com/rails/rails/commit/b68f0954 [3] Pull request 43850 in https://github.com/rails/rails [4] Pull request 41598 in https://github.com/rails/rails
26 lines
1.0 KiB
Ruby
26 lines
1.0 KiB
Ruby
# Be sure to restart your server when you modify this file.
|
|
|
|
# Define an application-wide content security policy.
|
|
# See the Securing Rails Applications Guide for more information:
|
|
# https://guides.rubyonrails.org/security.html#content-security-policy-header
|
|
|
|
# Rails.application.configure do
|
|
# config.content_security_policy do |policy|
|
|
# policy.default_src :self, :https
|
|
# policy.font_src :self, :https, :data
|
|
# policy.img_src :self, :https, :data
|
|
# policy.object_src :none
|
|
# policy.script_src :self, :https
|
|
# policy.style_src :self, :https
|
|
# # Specify URI for violation reports
|
|
# # policy.report_uri "/csp-violation-report-endpoint"
|
|
# end
|
|
#
|
|
# # Generate session nonces for permitted importmap and inline scripts
|
|
# config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }
|
|
# config.content_security_policy_nonce_directives = %w(script-src)
|
|
#
|
|
# # Report violations without enforcing the policy.
|
|
# # config.content_security_policy_report_only = true
|
|
# end
|