SecureHeaders v3.2.0 Release Notes
-
Cookies
๐ง SecureHeaders supports
Secure
,HttpOnly
andSameSite
cookies. These can be defined in the form of a boolean, or as a Hash for more refined configuration.Note: Regardless of the configuration specified, Secure cookies are only enabled for HTTPS requests.
๐ง Boolean-based configuration
๐ง Boolean-based configuration is intended to globally enable or disable a specific cookie attribute.
config.cookies = { secure: true, # mark all cookies as Secure httponly: false, # do not mark any cookies as HttpOnly }
๐ง Hash-based configuration
๐ง Hash-based configuration allows for fine-grained control.
config.cookies = { secure: { except: ['_guest'] }, # mark all but the `_guest` cookie as Secure httponly: { only: ['_rails_session'] }, # only mark the `_rails_session` cookie as HttpOnly }
๐ง SameSite cookie configuration
SameSite cookies permit either
Strict
orLax
enforcement mode options.config.cookies = { samesite: { strict: true # mark all cookies as SameSite=Strict } }
Strict
andLax
enforcement modes can also be specified using a Hash.config.cookies = { samesite: { strict: { only: ['_rails_session'] }, lax: { only: ['_guest'] } } }
Hash
๐
script
/style-src
hashes can be used to whitelist inline content that is static. This has the benefit of allowing inline content without opening up the possibility of dynamic javascript like you would with anonce
.You can add hash sources directly to your policy :
::SecureHeaders::Configuration.default do |config| config.csp = { default_src: %w('self') # this is a made up value but browsers will show the expected hash in the console. script_src: %w(sha256-123456) } end
You can also use the automated inline script detection/collection/computation of hash source values in your app.
rake secure_headers:generate_hashes
This will generate a file (
config/secure_headers_generated_hashes.yml
by default, you can override by settingENV["secure_headers_generated_hashes_file"]
) containing a mapping of file names with the array of hash values found on that page. When ActionView renders a given file, we check if there are any known hashes for that given file. If so, they are added as values to the header.--- scripts: app/views/asdfs/index.html.erb: - "'sha256-yktKiAsZWmc8WpOyhnmhQoDf9G2dAZvuBBC+V0LGQhg='" ๐ styles: app/views/asdfs/index.html.erb: - "'sha256-SLp6LO3rrKDJwsG9uJUxZapb4Wp2Zhj6Bu3l+d9rnAY='" - "'sha256-HSGHqlRoKmHAGTAJ2Rq0piXX4CnEbOl1ArNd6ejp2TE='"
Helpers
This will not compute dynamic hashes by design. The output of both helpers will be a plain
script
/style
tag without modification and the known hashes for a given file will be added toscript-src
/style-src
whenhashed_javascript_tag
andhashed_style_tag
are used. You can useraise_error_on_unrecognized_hash = true
to be extra paranoid that you have precomputed hash values for all of your inline content. By default, this will raise an error in non-production environments.๐ <%= hashed_style_tag do %> body { background-color: black; } <% end %> ๐ <%= hashed_style_tag do %> body { font-size: 30px; font-color: green; } <% end %> <%= hashed_javascript_tag do %> ๐ฒ console.log(1) <% end %>
๐ Content-Security-Policy: ... script-src 'sha256-yktKiAsZWmc8WpOyhnmhQoDf9G2dAZvuBBC+V0LGQhg=' ... ; style-src 'sha256-SLp6LO3rrKDJwsG9uJUxZapb4Wp2Zhj6Bu3l+d9rnAY=' 'sha256-HSGHqlRoKmHAGTAJ2Rq0piXX4CnEbOl1ArNd6ejp2TE=' ...;