Updated secure_headers gem to 3.0.0 #6908
Conversation
|
@martinpovolny please review |
|
cc @chrisarcand because of b42ddd6 |
| @@ -4,7 +4,7 @@ | |||
| config.x_content_type_options = "nosniff" | |||
| config.x_xss_protection = "1; mode=block" | |||
| config.csp = { | |||
| :enforce => true, | |||
There was a problem hiding this comment.
NOTE: this defaults to true, so it is not necessary
There was a problem hiding this comment.
Confused; Based on this you seem to be changing this value, as well as the config rename. Is this intended?
There was a problem hiding this comment.
@chrisarcand thanks - I was wrong. the migration guide said to s/enforce/report_only/
this was intentional
skateman
force-pushed
the
secureheaders-3
branch
from
001fec4
to
9d3dc46
Compare
|
👍 LGTM. lets merge when 🍏 |
|
<github_pr_commenter_batch />Some comments on commit skateman@9d3dc46 |
|
Checked commit skateman@9d3dc46 with ruby 2.2.3, rubocop 0.34.2, and haml-lint 0.13.0 |
|
@chrisarcand Are you 👍 to merge? |
|
Yeah, looks like that option was intended. 👍 |
Updated secure_headers gem to 3.0.0
|
thanks all |
Overriding the
connect-srcCSP is just a partial solution and after all our WebSocket connections are proxied through:443, it should be updated.