Skip to content

Add default parameter to content_security_policy_nonce for Rails compatibility #571

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Copilot wants to merge 10 commits into
base: main
Choose a base branch
from
Draft

Add default parameter to content_security_policy_nonce for Rails compatibility #571

Changes from 1 commit
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
d133044
fix(cookies): fix compatibility with rack 3
deril May 20, 2025
9bc0b6c
Remove non-lowercase headers in Rails default configuration (fixes #541)
obrie Mar 20, 2025
3334929
normalize domains with trailing slashes
keithamus Mar 30, 2022
7f19fb2
Fix tests (sources are no longer minified since #499)
fletchto99 Dec 16, 2025
b3557f7
Refactor rake task methods into module for better testing
rahearn Jun 2, 2022
5932e97
Initial plan
Copilot Dec 17, 2025
9b8201a
Fix content_security_policy_nonce to work without parameters for Rail…
Copilot Dec 17, 2025
3ba2401
Fix rubocop trailing whitespace issues
Copilot Dec 17, 2025
b6fb703
Address code review feedback: remove unnecessary begin blocks
Copilot Dec 17, 2025
bd6196a
Improve documentation clarity based on code review feedback
Copilot Dec 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Remove non-lowercase headers in Rails default configuration (fixes #541) 
While this gem now uses lowercase headers, the Rails default configuration still
defines non-lowercase headers.  As a result, our Railtie will not remove those
conflicting headers.

This change ensures that we're accounting for both lowercase and non-lowercase
default headers in Rails.
  • Loading branch information
@obrie @denn-os
obrie authored and denn-os committed Dec 17, 2025
commit 9bc0b6c805b342ef38fc0ca6d0a3f6d99214937f
9 changes: 6 additions & 3 deletions lib/secure_headers/railtie.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,12 @@ class Railtie < Rails::Railtie
ActiveSupport.on_load(:action_controller) do
include SecureHeaders

unless Rails.application.config.action_dispatch.default_headers.nil?
conflicting_headers.each do |header|
Rails.application.config.action_dispatch.default_headers.delete(header)
default_headers = Rails.application.config.action_dispatch.default_headers
unless default_headers.nil?
default_headers.each_key do |header|
if conflicting_headers.include?(header.downcase)
default_headers.delete(header)
end
end
end
end
Expand Down