Security: CSP
This course reads the Content Security Policy of one Rails application line by line. It explains how directives fall back to default-src, and why base-uri, form-action and frame-ancestors do not. It compares allowlists with nonces, hashes and strict-dynamic, and examines each exception in the policy, such as unsafe-inline in style-src and wasm-unsafe-eval. It covers rolling out a policy with report-only mode and a reporting endpoint. It ends with an ordered plan for hardening the policy.
What you'll learn
- ✓How CSP stops an injected payload from executing
- ✓Which directives fall back to default-src and which do not
- ✓How nonces, hashes and strict-dynamic replace host allowlists
- ✓How to judge each exception in a policy
- ✓How to roll out a policy with report-only mode
- ✓An ordered plan to harden an existing Rails policy
The policy this app already has
Most Rails applications have config/initializers/content_security_policy.rb sitting there entirely commented out. This one does not.
Read the full lesson free →Curriculum
7 lessonsThe policy this app already has
Reads this Rails app's active CSP initializer, its directives, the session-based nonce and csp_meta_tag.
Directives and the fallback chain
Explains how fetch directives replace default-src, which three directives have no fallback, and what source values mean.
Nonces, hashes and strict-dynamic
Compares host allowlists with nonce and hash policies, weighs the session nonce generator, and explains strict-dynamic.
The exceptions in this policy
Examines each exception in this policy, from unsafe-inline styles to wasm-unsafe-eval, blob, https and data sources.
Rolling out, and report-only mode
Shows how report-only headers, a reporting endpoint and filtered reports support a gradual and safe policy rollout.
Beyond script-src
Covers frame-ancestors, base-uri and form-action against HTML-only attacks, plus Trusted Types, sandbox and CSP's limits.
Putting it together: hardening this policy
Audits this policy and orders the hardening work: missing directives, a per-response nonce, then removing inline styles.