From dd9b28787ce997e79f5e76b4c2ded2713020b9ae Mon Sep 17 00:00:00 2001 From: Matt-Yorkley <9029026+Matt-Yorkley@users.noreply.github.com> Date: Thu, 27 Jul 2023 16:20:42 +0100 Subject: [PATCH] Update CSP configuration for Safari Apparently some versions of Safari have issues with Websockets if the CSP doesn't explicitly define the `connect_src` in a certain way (including specifying the host). This issue is fixed in later versions of Safari and doesn't affect other browsers, for which the `default_src` with `:self` is sufficient. --- config/initializers/content_security_policy.rb | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb index 73fbf5890a..9a584f2850 100644 --- a/config/initializers/content_security_policy.rb +++ b/config/initializers/content_security_policy.rb @@ -14,7 +14,12 @@ Rails.application.config.content_security_policy do |policy| policy.script_src :self, :https, :unsafe_inline, :unsafe_eval, "*.stripe.com", "openfoodnetwork.innocraft.cloud", "maps.googleapis.com", "maps.gstatic.com", "d2wy8f7a9ursnm.cloudfront.net" policy.style_src :self, :https, :unsafe_inline, "fonts.googleapis.com", "cdnjs.cloudflare.com" - policy.connect_src :self, :https, "http://localhost:3035", "ws://localhost:3035" if Rails.env.development? + + if Rails.env.development? + policy.connect_src :self, :https, "http://localhost:3035", "ws://localhost:3035", "ws://localhost:3000" + else + policy.connect_src :self, :https, "https://#{ENV["SITE_URL"]}", "wss://#{ENV["SITE_URL"]}" + end # Specify URI for violation reports # policy.report_uri "/csp-violation-report-endpoint"