Class: Pah::Templates::SecureHeader

Inherits:
Pah::Template
  • Object
show all
Defined in:
lib/pah/templates/secure_headers.rb

Instance Method Summary collapse

Methods inherited from Pah::Template

#ask_unless_test, #copy_static_file, #git_commit, #static_files, #will_you_like_to?

Instance Method Details

#call ⇒ Object 



4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
 
# File 'lib/pah/templates/secure_headers.rb', line 4

def call
  create_file 'config/initializers/secure_headers.rb' do
    "::SecureHeaders::Configuration.configure do |config|\n  config.hsts = \"max-age=\#{20.years.to_i}; includeSubdomains; preload\"\n  config.x_frame_options = 'DENY'\n  config.x_content_type_options = \"nosniff\"\n  config.x_xss_protection = \"1; mode=block\"\n  config.csp = {\n    report_only: Rails.env.production?, # for the Content-Security-Policy-Report-Only header\n    preserve_schemes: false, # default: false.\n\n    default_src: %w(*), # all allowed in the beginning\n    script_src: %w('self' 'unsafe-inline'), # scripts only allowed in external files from the same origin\n    connect_src: %w('self'), # Ajax may connect only to the same origin\n    style_src: %w('self' 'unsafe-inline'), # styles only allowed in external files from the same origin and in style attributes (for now)\n    # report_uri: [\"/csp_report?report_only=\#{Rails.env.production?}\"] # violation reports will be sent here\n  }\nend\n"
  end
  git add: 'config/initializers/secure_headers.rb'
  git_commit 'Add secure headers.'
end