Content Security Policy

By default, the Content Security Policy (CSP) should be enabled in every new project, since it is an added layer of security that helps in detecting and mitigating attacks, such as Cross Site Scripting (XSS) or Data Injection Attacks.

It works by telling the browser which sources are trustworthy. Everything that does not come from a trusted source is blocked and a violation is reported to the report-uri (You can also opt-in for reporting only. However, this is not recommended since it is not effective when it comes to actually preventing an attack. One possible scenario, where reporting only would be useful would be, when CSP should be introduced to a new project, but blocking would possibly cause the site to malfunction).

Setup

Content Security Policy can be enabled by uncommenting the code given in config/initializers/content_security_policy.rb. This file has the following structure after configuration:

Rails.application.config.content_security_policy do |policy|
  policy.default_src :self, :https
  policy.font_src    :self, :https, ...
  policy.img_src     ...
  policy.object_src  ...
  policy.script_src  ...
  policy.style_src   ...
  policy.connect_src :self, :https, 'http://localhost:3035', 'ws://localhost:3035' if Rails.env.development?
  policy.connect_src :self, :https if Rails.env.production?

  policy.report_uri ENV['CSP_REPORT_URI'] if ENV['CSP_REPORT_URI']
end

Details on how to setup Sentry reporting can be found in the Sentry guide.

Common Rules

Warning: This list may be incomplete. Please feel free to modify or add if you see something missing!

Sentry

Google Tag Manager

Where the tracking script looks like:

<script nonce="{generated_nonce}"><!-- Google Tag Manager Tracking Code --></script>

Alternatively, if 'unsafe-inline' is already set, the nonce can be left out.

Starting from Rails 6 on, the javascript_tag view helper also accepts a nonce option:

<%= javascript_tag nonce: true do %>
  // code
<% end %>

With Preview Mode Enabled

Universal Analytics (Google Analytics)

For a more details list, see https://developers.google.com/tag-manager/web/csp

Facebook Tracking Pixel

Google Fonts

Stripe

Checkout

Stripe.js

Aiaibot