From 9bc593d6753922d995867b632477d4d3b9e86e20 Mon Sep 17 00:00:00 2001 From: beatrix-bitrot Date: Sun, 14 May 2017 20:56:30 +0000 Subject: [PATCH] update local modifications for cors and cp --- config/application.rb | 5 ++++- config/environments/production.rb | 11 +++++++---- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/config/application.rb b/config/application.rb index ac63e0e942..dd63017b3c 100644 --- a/config/application.rb +++ b/config/application.rb @@ -71,10 +71,13 @@ module Mastodon config.middleware.insert_before 0, Rack::Cors do allow do origins '*' - resource '/assets/*', headers: :any, methods: [:get, :head, :options] resource '/@:username', headers: :any, methods: [:get], credentials: false resource '/api/*', headers: :any, methods: [:post, :put, :delete, :get, :patch, :options], credentials: false, expose: ['Link', 'X-RateLimit-Reset', 'X-RateLimit-Limit', 'X-RateLimit-Remaining', 'X-Request-Id'] resource '/oauth/token', headers: :any, methods: [:post], credentials: false + resource '/assets/*', headers: :any, methods: [:get, :head, :options] + resource '/stylesheets/*', headers: :any, methods: [:get, :head, :options] + resource '/javascripts/*', headers: :any, methods: [:get, :head, :options] + resource '/packs/*', headers: :any, methods: [:get, :head, :options] end end diff --git a/config/environments/production.rb b/config/environments/production.rb index bd87d79a78..68229531d2 100644 --- a/config/environments/production.rb +++ b/config/environments/production.rb @@ -93,9 +93,12 @@ Rails.application.configure do end config.action_dispatch.default_headers = { - 'Server' => 'Mastodon', - 'X-Frame-Options' => 'DENY', - 'X-Content-Type-Options' => 'nosniff', - 'X-XSS-Protection' => '1; mode=block', + 'Server' => 'Mastodon', + 'X-Frame-Options' => 'DENY', + 'X-Content-Type-Options' => 'nosniff', + 'X-XSS-Protection' => '1; mode=block', + 'Content-Security-Policy' => "frame-ancestors 'none'; object-src 'none'; script-src 'self' https://dev-static.glitch.social 'unsafe-inline'; base-uri 'none';" , + 'Referrer-Policy' => 'no-referrer, strict-origin-when-cross-origin', + 'Strict-Transport-Security' => 'max-age=63072000; includeSubDomains; preload' } end