Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upIgnoring CSP on some formats #437
Open
Comments
|
I think there are a couple ways to accomplish this. Forgive me, this is a bit pseudo-code-ey. before_action :no_csp_plz
SecureHeaders::Configuration.override(:no_csp) do |config|
config.csp = SecureHeaders::OPT_OUT
end
def no_csp_plz
if content type is pdf
use_secure_headers_override(:no_csp)
end
endOr before_action :no_csp_plz
def no_csp_plz
if content type is pdf
opt_out_of_header(:csp)
end
endIf I had to pick, I'd say the first option is more idiomatic. You can probably move that |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Feature Requests
I found a bug of display of PDFs in Chrome. See https://bugs.chromium.org/p/chromium/issues/detail?id=271452
Would it possible to disable CSP on every .pdf for example?