Fix missing nonce in production CSP

9 years ago · 6428cee512
parent 481233050d
commit 6428cee512
1 changed files with 1 additions and 1 deletions
--- a/lib/app.rb
+++ b/lib/app.rb
@ -73,7 +73,7 @@ class App < Sinatra::Application
  configure :production do
    set :static, false
    set :docs_host, '//docs.devdocs.io'
-    set :csp, "default-src 'self' *; script-src 'self' http://cdn.devdocs.io https://cdn.devdocs.io https://www.google-analytics.com https://secure.gaug.es http://*.jquery.com https://*.jquery.com; font-src data:; style-src 'self' 'unsafe-inline' *; img-src 'self' * data:;"
+    set :csp, "default-src 'self' *; script-src 'self' 'nonce-devdocs' http://cdn.devdocs.io https://cdn.devdocs.io https://www.google-analytics.com https://secure.gaug.es http://*.jquery.com https://*.jquery.com; font-src data:; style-src 'self' 'unsafe-inline' *; img-src 'self' * data:;"
    use Rack::ConditionalGet
    use Rack::ETag