Methods
C
N
Constants
CONTENT_TYPE = "Content-Type".freeze
 
POLICY = "Content-Security-Policy".freeze
 
POLICY_REPORT_ONLY = "Content-Security-Policy-Report-Only".freeze
 
Class Public methods
new(app)

Source: show | on GitHub 

# File actionpack/lib/action_dispatch/http/content_security_policy.rb, line 11
def initialize(app)
  @app = app
end
Instance Public methods
call(env)

Source: show | on GitHub 

# File actionpack/lib/action_dispatch/http/content_security_policy.rb, line 15
def call(env)
  request = ActionDispatch::Request.new env
  _, headers, _ = response = @app.call(env)

  return response unless html_response?(headers)
  return response if policy_present?(headers)

  if policy = request.content_security_policy
    if policy.directives["script-src"]
      if nonce = request.content_security_policy_nonce
        policy.directives["script-src"] << "'nonce-#{nonce}'"
      end
    end

    headers[header_name(request)] = policy.build(request.controller_instance)
  end

  response
end