From 0c6783816e0a7a8acad922296d3eb8cc454fb981 Mon Sep 17 00:00:00 2001
From: erdgeist <erdgeist@erdgeist.org>
Date: Sat, 18 Jul 2026 16:30:31 +0200
Subject: Emit a report-only Content-Security-Policy with nonced inline scripts

- dark-mode restore now travels nonced, the admin constants likewise
- AUTH_TOKEN deleted in favour of the csrf meta tag
- new report collector at /csp_reports
---
 config/routes.rb | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'config/routes.rb')

diff --git a/config/routes.rb b/config/routes.rb
index f3893266..3aa5c69b 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -9,6 +9,8 @@ Cccms::Application.routes.draw do
       defaults: { page_path: ['home'] },
       constraints: { locale: /de|en/ }
 
+  post 'csp_reports' => 'csp_reports#create'
+
   # All application routes are scoped under an optional two-letter locale
   # prefix: /de/... and /en/... Both forms are valid; the prefix is omitted
   # for the default locale (:de) in generated URLs via default_url_options
-- 
cgit v1.3