From 0c6783816e0a7a8acad922296d3eb8cc454fb981 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Sat, 18 Jul 2026 16:30:31 +0200 Subject: Emit a report-only Content-Security-Policy with nonced inline scripts - dark-mode restore now travels nonced, the admin constants likewise - AUTH_TOKEN deleted in favour of the csrf meta tag - new report collector at /csp_reports --- test/integration/csp_header_test.rb | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 test/integration/csp_header_test.rb (limited to 'test/integration') diff --git a/test/integration/csp_header_test.rb b/test/integration/csp_header_test.rb new file mode 100644 index 00000000..73707edb --- /dev/null +++ b/test/integration/csp_header_test.rb @@ -0,0 +1,12 @@ +require 'test_helper' + +class CspHeaderTest < ActionDispatch::IntegrationTest + test "public responses carry the report-only CSP header with a nonce" do + get "/" + + header = response.headers["Content-Security-Policy-Report-Only"] + assert header.present? + assert_includes header, "script-src" + assert_includes header, "nonce-" + end +end -- cgit v1.3