Implement: Missing Content Security Policy Configuration

[revise-dev]

Closes #26

The Content Security Policy (CSP) configuration was initially generated by Rails but left commented out, leaving the application without proper content security controls. The original configuration showed basic CSP directives but needed to be customized for this specific application's requirements.

The solution implements a comprehensive CSP that:

1. Restricts default content sources to same-origin (policy.default_src :self) as a secure baseline
2. Allows font loading from same-origin, HTTPS sources, and data URIs (policy.font_src :self, :https, :data) to support web fonts
3. Permits images from same-origin, HTTPS sources, and data URIs (policy.img_src :self, :https, :data) for avatar images and other visual content
4. Blocks all object sources (policy.object_src :none) to prevent plug-in based attacks
5. Allows scripts from same-origin and HTTPS sources (policy.script_src :self, :https) while including unsafe_inline to support Tailwind CSS functionality
6. Configures style sources similarly to scripts (policy.style_src :self, :https, :unsafe_inline) for Tailwind CSS
7. Enables connections to GitHub's domain (policy.connect_src :self, "https://github.com") for OAuth authentication
8. Prevents clickjacking by setting frame ancestors to none (policy.frame_ancestors :none)
9. Restricts base URI to same-origin (policy.base_uri :self) for security
10. Allows form submissions to same-origin and GitHub (policy.form_action :self, "https://github.com") for authentication

The solution also implements nonce generation for better inline script/style security, using the session ID as a stable nonce source. This maintains security while allowing necessary functionality for Tailwind CSS and other inline requirements.

The configuration balances security with functionality, specifically accommodating:

• GitHub OAuth integration
• Tailwind CSS styling
• Avatar image loading
• Font loading
• Internal application functionality

While unsafe_inline is included for scripts and styles, this is a necessary trade-off for Tailwind CSS functionality. The risk is partially mitigated by strict controls on other directives and the use of nonces.

Tip

You can make revisions or ask questions of Revise.dev by using /revise in any comment or review!

• /revise Add a comment above the method to explain why we're making this change.
• /revise Why did you choose to make this change specifically?

Important

If something doesn’t look right, click to retry this interaction.

Quick links: View GitHub issue • View in Revise