CSP: drop 'self' in script-src (#6611)

2025-05-21 18:12:32 +08:00 · 2018-11-15 12:14:16 -05:00
parent 5a542327e7
commit 055d59373a
3 changed files with 79 additions and 24 deletions
--- a/spec/requests/application_controller_spec.rb
+++ b/spec/requests/application_controller_spec.rb
@ -259,7 +259,6 @@ RSpec.describe ApplicationController do
      script_src = parse(response.headers['Content-Security-Policy'])['script-src']

      expect(script_src).to include('example.com')
-      expect(script_src).to include("'self'")
      expect(script_src).to include("'unsafe-eval'")
    end