跳至内容 跳至搜索

Action Dispatch 内容安全策略

配置 HTTP 内容安全策略 响应头以帮助防止 XSS 和注入攻击。

全局策略示例

Rails.application.config.content_security_policy do |policy|
  policy.default_src :self, :https
  policy.font_src    :self, :https, :data
  policy.img_src     :self, :https, :data
  policy.object_src  :none
  policy.script_src  :self, :https
  policy.style_src   :self, :https

  # Specify URI for violation reports
  policy.report_uri "/csp-violation-report-endpoint"
end
命名空间
方法
B
I
N
P
R
S
U

属性

[R] directives

类公共方法

new()

来源：显示 | 在 GitHub 上

# File actionpack/lib/action_dispatch/http/content_security_policy.rb, line 177
def initialize
  @directives = {}
  yield self if block_given?
end

实例公共方法

block_all_mixed_content(enabled = true)

指定是否阻止用户代理在页面使用 HTTPS 时加载任何 HTTP 上的资产

policy.block_all_mixed_content

传递 false 以再次允许

policy.block_all_mixed_content false

来源：显示 | 在 GitHub 上

# File actionpack/lib/action_dispatch/http/content_security_policy.rb, line 205
def block_all_mixed_content(enabled = true)
  if enabled
    @directives["block-all-mixed-content"] = true
  else
    @directives.delete("block-all-mixed-content")
  end
end

build(context = nil, nonce = nil, nonce_directives = nil)

来源：显示 | 在 GitHub 上

# File actionpack/lib/action_dispatch/http/content_security_policy.rb, line 294
def build(context = nil, nonce = nil, nonce_directives = nil)
  nonce_directives = DEFAULT_NONCE_DIRECTIVES if nonce_directives.nil?
  build_directives(context, nonce, nonce_directives).compact.join("; ")
end

initialize_copy(other)

来源：显示 | 在 GitHub 上

# File actionpack/lib/action_dispatch/http/content_security_policy.rb, line 182
def initialize_copy(other)
  @directives = other.directives.deep_dup
end

plugin_types(*types)

限制可以嵌入的插件集

policy.plugin_types "application/x-shockwave-flash"

保持为空以允许所有插件

policy.plugin_types

来源：显示 | 在 GitHub 上

# File actionpack/lib/action_dispatch/http/content_security_policy.rb, line 221
def plugin_types(*types)
  if types.first
    @directives["plugin-types"] = types
  else
    @directives.delete("plugin-types")
  end
end

report_uri(uri)

启用 report-uri 指令。违规报告将发送到指定的 URI

policy.report_uri "/csp-violation-report-endpoint"

来源：显示 | 在 GitHub 上

# File actionpack/lib/action_dispatch/http/content_security_policy.rb, line 235
def report_uri(uri)
  @directives["report-uri"] = [uri]
end

require_sri_for(*types)

指定需要 子资源完整性 的资产类型

policy.require_sri_for :script, :style

保持为空以不需要子资源完整性

policy.require_sri_for

来源：显示 | 在 GitHub 上

# File actionpack/lib/action_dispatch/http/content_security_policy.rb, line 247
def require_sri_for(*types)
  if types.first
    @directives["require-sri-for"] = types
  else
    @directives.delete("require-sri-for")
  end
end

sandbox(*values)

指定是否应该为请求的资源启用 沙盒

policy.sandbox

值可以作为参数传递

policy.sandbox "allow-scripts", "allow-modals"

传递 false 以禁用沙盒

policy.sandbox false

来源：显示 | 在 GitHub 上

# File actionpack/lib/action_dispatch/http/content_security_policy.rb, line 268
def sandbox(*values)
  if values.empty?
    @directives["sandbox"] = true
  elsif values.first
    @directives["sandbox"] = values
  else
    @directives.delete("sandbox")
  end
end

upgrade_insecure_requests(enabled = true)

指定用户代理是否应该将 HTTP 上的任何资产视为 HTTPS

policy.upgrade_insecure_requests

传递 false 以禁用它

policy.upgrade_insecure_requests false

来源：显示 | 在 GitHub 上

# File actionpack/lib/action_dispatch/http/content_security_policy.rb, line 286
def upgrade_insecure_requests(enabled = true)
  if enabled
    @directives["upgrade-insecure-requests"] = true
  else
    @directives.delete("upgrade-insecure-requests")
  end
end