Rails meets Content Security Policy 竹内雄一 Takeyu Web Inc.

@takeyuweb 2008年〜フリーランス 2016年 法人成り Rails 1.1〜 Saitama.rb主宰

Takeyu Web Inc.

Rails 5.2 Content Security Policy config/initializers/ content_security_policy.rb Rails.application.config.content_security_policy do |policy| policy.default_src :self, :https policy.font_src :self, :https, :data policy.img_src :self, :https, :data policy.object_src :none policy.script_src :self, :https policy.style_src :self, :https # Specify URI for violation reports policy.report_uri "/csp-violation-report-endpoint" end

Rails 5.2 Content Security Policy Override policy inline class PostsController < ApplicationController content_security_policy do |p| p.upgrade_insecure_requests true end end

Rails 5.2 Content Security Policy https://speakerdeck.com/yyagi/ rails-5-dot-2-part1?slide=23 http://guides.rubyonrails.org/ security.html#content-security-policy

What’s CSP? IPA ISEC　セキュア・プログラミング講 座より Content Security Policy は、スク リプトのロードと実行等に強い制 約を設ける機能 https://www.ipa.go.jp/security/ awareness/vendor/programmingv2/ contents/705.html

HTTP Header GET /index.html Host: test.host HTTP/1.1 200 OK Content-Security-Policy: default-src 'self'

default-src ‘self’ alert("実 行 さ れ な い ");

script-src ‘https:’

script-src ‘self’ ‘unsafe- inline’ alert("実行される");

script-src ‘nonce- xxxxxxxxxxxxxx’ nonce: number used once alert("実行されない"); alert("実行される");

report-uri /csp-report ブロックしたとき、CSPレポートを送信 する POST /csp-report { "csp-report": { "blocked-uri": "self", "document-uri": "http://localhost:3000/", "original-policy": "script-src ...", "referrer": "", "script-sample": "onclick attribute on A element", "source-file": "http://localhost:3000/", "violated-directive": "script-src" } }

Directives base-uri child-src connect-src default-src font-src form- action frame-ancestors frame- src img-src manifest-src media- src object-src script-src style- src worker-src

Content-Security-Policy- Report-Only Report Only Content-Security-Policy-Report-Only: default-src https: report-to https://test.host/csp-report

Supported browsers ブラウザー実装状況 Content Security Policy (CSP) - HTTP MDN

Rails integration config/initializers/ content_security_policy.rb Rails.application.config.content_security_policy do |policy| policy.default_src :self, :https policy.font_src :self, :https, :data policy.img_src :self, :https, :data policy.object_src :none policy.script_src :self, :https policy.style_src :self, :https # Specify URI for violation reports policy.report_uri "/csp-violation-report-endpoint" end

Rails integration Override policy inline class PostsController < ApplicationController content_security_policy do |p| p.upgrade_insecure_requests true end end

Rails integration <%= javascript_tag do %> alert('Without nonce'); <% end %> <%= javascript_tag nonce: true do %> alert('With nonce'); <% end %>

Supported directives actionpack/lib/action_dispatch/http/ content_security_policy.rb

Enjoy Secure Programing!