Emit a report-only Content-Security-Policy with nonced inline scripts

- dark-mode restore now travels nonced, the admin constants likewise
- AUTH_TOKEN deleted in favour of the csrf meta tag
- new report collector at /csp_reports

1 files changed, 10 insertions, 0 deletions

diff --git a/app/controllers/csp_reports_controller.rb b/app/controllers/csp_reports_controller.rb
new file mode 100644
index 0000000..08cbc98
--- /dev/null
+++ b/app/controllers/csp_reports_controller.rb
@@ -0,0 +1,10 @@
+class CspReportsController < ApplicationController
+  # Browsers POST application/csp-report with no CSRF token, no session.
+  skip_before_action :verify_authenticity_token
+
+  def create
+    report = request.body.read(8192)
+    Rails.logger.warn("CSP violation: #{report}") if report.present?
+    head :no_content
+  end
+end