app/controllers/application_controller.rb
# Use the new HTTP security header, "Permissions policy", to disable things
# we don't need. It was formerly named "feature policy" with a slightly
# different syntax. See:
# https://scotthelme.co.uk/goodbye-feature-policy-and-hello-permissions-policy
# https://httptoolkit.tech/blog/renaming-feature-policy-to-permissions-policy
# https://scotthelme.co.uk/a-new-security-header-feature-policy/
# Note that this *gives up* fullscreen & sync-xhr; if we need it later,
# change the policy.
# rubocop: disable Metrics/MethodLength
Use the new HTTP security header, "Permissions policy", to disable things
we don't need. It was formerly named "feature policy" with a slightly
different syntax.
Use the new HTTP security header " Permissions policy " to disable things we don ' t need . It was formerly named " feature policy " with a slightly different syntax .
def add_http_permissions_policy
    response.set_header(
      'Permissions-Policy',
      'fullscreen=(), geolocation=(), midi=(), ' \
      'notifications=(), push=(), sync-xhr=(), microphone=(), ' \
      'camera=(), magnetometer=(), gyroscope=(), speaker=(), ' \
      'vibrate=(), payment=()'
    )
    response.set_header(
      'Feature-Policy',
      "fullscreen 'none'; geolocation 'none'; midi 'none';" \
      "notifications 'none'; push 'none'; sync-xhr 'none'; microphone 'none';" \
      "camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none';" \
      "vibrate 'none'; payment 'none'"
    )
  end
def add_http_permissions_policy response . set_header ( 'Permissions-Policy' , 'fullscreen=(), geolocation=(), midi=(), ' 'notifications=(), push=(), sync-xhr=(), microphone=(), ' 'camera=(), magnetometer=(), gyroscope=(), speaker=(), ' 'vibrate=(), payment=()' ) response . set_header ( 'Feature-Policy' , "fullscreen 'none'; geolocation 'none'; midi 'none';" "notifications 'none'; push 'none'; sync-xhr 'none'; microphone 'none';" "camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none';" "vibrate 'none'; payment 'none'" ) end
Use the new HTTP security header, "Permissions policy", to disable things
we don't need.
Use the new HTTP security header " Permissions policy " to disable things we don ' t need .
# Include the older Feature-Policy header, for older browser versions. # We can eventually drop this, but it doesn't hurt to include it for now.