Enforce CSP in dev environment

9 years ago · bdda2fbfe6
parent d9e64f9d06
commit bdda2fbfe6
1 changed files with 2 additions and 0 deletions
--- a/lib/app.rb
+++ b/lib/app.rb
@ -66,6 +66,8 @@ class App < Sinatra::Application
    use BetterErrors::Middleware
    BetterErrors.application_root = File.expand_path('..', __FILE__)
    BetterErrors.editor = :sublime
+
+    set :csp, "default-src 'self' *; script-src 'self' 'unsafe-inline' *; font-src data:; style-src 'self' 'unsafe-inline' *; img-src 'self' * data:;"
  end

  configure :production do