Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve Content Security Policy documentation [ci-skip] #44470

Merged
merged 1 commit into from Feb 18, 2022

Conversation

p8
Copy link
Member

@p8 p8 commented Feb 17, 2022

Summary

  • Use "HTTP Content-Security-Policy response header" instead of "Content
    Security Policy", to make it clear the header will be set.
  • Document report_uri in the guides.
  • Instead of having a long list of examples in the guide, add a
    description to each example.

Before

image

image

image

After

image

image

image

Copy link
Member

@jonathanhefner jonathanhefner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice! 👍

guides/source/security.md Outdated Show resolved Hide resolved
guides/source/security.md Show resolved Hide resolved
guides/source/security.md Outdated Show resolved Hide resolved
guides/source/security.md Outdated Show resolved Hide resolved
guides/source/security.md Outdated Show resolved Hide resolved
Comment on lines 1146 to 1148
```

```ruby
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When code snippets are from different contexts (e.g. config/initializers/content_security_policy.rb and app/controllers/posts_controller.rb), I prefer to keep the code blocks separate to provide visual distinction in the rendered output. Also, it gives each snippet a dedicated "Copy" button.

(I did some work toward that in #40922.)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, good point. I agree.

- Use "HTTP Content-Security-Policy response header" instead of "Content
  Security Policy", to make it clear the header will be set.
- Instead of having a long list of examples in the guide, add a
  description to each example.

Co-authored-by: Jonathan Hefner <jonathan@hefner.pro>
@jonathanhefner jonathanhefner merged commit 258e9ad into rails:main Feb 18, 2022
@jonathanhefner
Copy link
Member

jonathanhefner commented Feb 18, 2022

Thank you, @p8! 🚀

Backported to 7-0-stable in 503d1f9.

jonathanhefner added a commit that referenced this pull request Feb 18, 2022
Improve Content Security Policy documentation [ci-skip]

(cherry picked from commit 258e9ad)
@p8 p8 deleted the docs/csp-header branch February 18, 2022 17:59
@p8
Copy link
Member Author

p8 commented Feb 18, 2022

Thanks @jonathanhefner !

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants