Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow api-docs CSP to be supplied #567

Open
hlascelles opened this issue Nov 2, 2022 · 5 comments · May be fixed by #716
Open

Allow api-docs CSP to be supplied #567

hlascelles opened this issue Nov 2, 2022 · 5 comments · May be fixed by #716
Labels
enhancement question
Milestone
Gem 2.X.0

Comments

@hlascelles
Copy link

Problem

In rswag 2.7.0 a CSP is now provided/enforced on the /api-docs page: #263

CSPs are a Good Thing, so this is good. Unfortunately we have some scripts and images in our docs which now won't load.

Workaround

We can currently monkey-patch this method and supply our own:

rswag/rswag-ui/lib/rswag/ui/middleware.rb

Line 43 in ec12c83

def csp

Proposal

Can we formalise setting the CSP instead of using a monkey patch? I can do a PR. Do you have a preference as to how to do it?

Thanks!
@Aesthetikx
Copy link

I also ran into this, both with an image URL and with the swagger yaml file itself.

@sbiastoch
Copy link

I would love to see this, we also just faced this.

@richardonrails
Copy link

👍 I had to workaround this issue too:
#619 (comment)

@terrainoob
Copy link

👍 +1 Same issue and desire, specifically with connect-src

@romanblanco
Copy link
Member

romanblanco commented Dec 20, 2023 •
edited

@hlascelles, thank you for reporting this.

Could you put together a PR to enable setting the csp via rswag-ui configuration?

Do you have another proposal?

@romanblanco romanblanco linked a pull request Dec 20, 2023 that will close this issue
Add custom content security policy configurations #716
Open
1 task
@domaindrivendev domaindrivendev added this to the Gem 2.X.0 milestone May 16, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement question
Projects
None yet
Milestone
Gem 2.X.0
Development

Successfully merging a pull request may close this issue.

Add custom content security policy configurations erimicel/rswag
7 participants
@terrainoob @hlascelles @romanblanco @Aesthetikx @domaindrivendev @sbiastoch @richardonrails