跳至内容 跳至搜索

Action Dispatch 内容安全策略 ↑

配置 HTTP Content-Security-Policy 响应头，以帮助防御 XSS 和注入攻击。

示例全局策略

Rails.application.config.content_security_policy do |policy|
  policy.default_src :self, :https
  policy.font_src    :self, :https, :data
  policy.img_src     :self, :https, :data
  policy.object_src  :none
  policy.script_src  :self, :https
  policy.style_src   :self, :https

  # Specify URI for violation reports
  policy.report_uri "/csp-violation-report-endpoint"
end
命名空间
方法
B
I
N
P
R
S
U

常量

HASH_SOURCE_ALGORITHM_PREFIXES = ["sha256-", "sha384-", "sha512-"].freeze
 

Attributes

[R] directives

类公共方法

new()

来源: 显示 | 在 GitHub 上

# File actionpack/lib/action_dispatch/http/content_security_policy.rb, line 182
def initialize
  @directives = {}
  yield self if block_given?
end

实例公共方法

block_all_mixed_content(enabled = true)

指定是否阻止用户代理在页面使用 HTTPS 时通过 HTTP 加载任何资源

policy.block_all_mixed_content

传递 false 以再次允许

policy.block_all_mixed_content false

来源: 显示 | 在 GitHub 上

# File actionpack/lib/action_dispatch/http/content_security_policy.rb, line 210
def block_all_mixed_content(enabled = true)
  if enabled
    @directives["block-all-mixed-content"] = true
  else
    @directives.delete("block-all-mixed-content")
  end
end

build(context = nil, nonce = nil, nonce_directives = nil)

来源: 显示 | 在 GitHub 上

# File actionpack/lib/action_dispatch/http/content_security_policy.rb, line 299
def build(context = nil, nonce = nil, nonce_directives = nil)
  nonce_directives = DEFAULT_NONCE_DIRECTIVES if nonce_directives.nil?
  build_directives(context, nonce, nonce_directives).compact.join("; ")
end

initialize_copy(other)

来源: 显示 | 在 GitHub 上

# File actionpack/lib/action_dispatch/http/content_security_policy.rb, line 187
def initialize_copy(other)
  @directives = other.directives.deep_dup
end

plugin_types(*types)

限制可嵌入的插件集

policy.plugin_types "application/x-shockwave-flash"

留空以允许所有插件

policy.plugin_types

来源: 显示 | 在 GitHub 上

# File actionpack/lib/action_dispatch/http/content_security_policy.rb, line 226
def plugin_types(*types)
  if types.first
    @directives["plugin-types"] = types
  else
    @directives.delete("plugin-types")
  end
end

report_uri(uri)

启用 report-uri 指令。违规报告将发送到指定的 URI

policy.report_uri "/csp-violation-report-endpoint"

来源: 显示 | 在 GitHub 上

# File actionpack/lib/action_dispatch/http/content_security_policy.rb, line 240
def report_uri(uri)
  @directives["report-uri"] = [uri]
end

require_sri_for(*types)

指定需要 Subresource Integrity 的资源类型

policy.require_sri_for :script, :style

留空以不要求 Subresource Integrity

policy.require_sri_for

来源: 显示 | 在 GitHub 上

# File actionpack/lib/action_dispatch/http/content_security_policy.rb, line 252
def require_sri_for(*types)
  if types.first
    @directives["require-sri-for"] = types
  else
    @directives.delete("require-sri-for")
  end
end

sandbox(*values)

指定是否为请求的资源启用 sandbox

policy.sandbox

值可以作为参数传递

policy.sandbox "allow-scripts", "allow-modals"

传递 false 以禁用 sandbox

policy.sandbox false

来源: 显示 | 在 GitHub 上

# File actionpack/lib/action_dispatch/http/content_security_policy.rb, line 273
def sandbox(*values)
  if values.empty?
    @directives["sandbox"] = true
  elsif values.first
    @directives["sandbox"] = values
  else
    @directives.delete("sandbox")
  end
end

upgrade_insecure_requests(enabled = true)

指定用户代理是否应将 HTTP 上的任何资源视为 HTTPS

policy.upgrade_insecure_requests

传递 false 以禁用它

policy.upgrade_insecure_requests false

来源: 显示 | 在 GitHub 上

# File actionpack/lib/action_dispatch/http/content_security_policy.rb, line 291
def upgrade_insecure_requests(enabled = true)
  if enabled
    @directives["upgrade-insecure-requests"] = true
  else
    @directives.delete("upgrade-insecure-requests")
  end
end