LTI-179: Chance X-Frame-Opts to Content-Security-Policy (#113)

config/application.rb

@@ -38,10 +38,5 @@ class Application < Rails::Application
 
     config.relative_url_root = "/#{ENV['RELATIVE_URL_ROOT'] || 'lti'}"
     config.assets.prefix = "#{config.relative_url_root}/assets"
-
-    # Allow this to work in an iframe on another domain
-    config.action_dispatch.default_headers = {
-      'X-Frame-Options' => 'ALLOWALL',
-    }
   end
 end

config/initializers/content_security_policy.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+# BigBlueButton open source conferencing system - http://www.bigbluebutton.org/.
+# Copyright (c) 2018 BigBlueButton Inc. and by respective authors (see below).
+# This program is free software; you can redistribute it and/or modify it under the
+# terms of the GNU Lesser General Public License as published by the Free Software
+# Foundation; either version 3.0 of the License, or (at your option) any later
+# version.
+#
+# BigBlueButton is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
+# You should have received a copy of the GNU Lesser General Public License along
+# with BigBlueButton; if not, see <http://www.gnu.org/licenses/>.
+
+# Be sure to restart your server when you modify this file.
+
+# Define an application-wide content security policy
+# For further information see the following documentation
+# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
+
+Rails.application.config.content_security_policy do |policy| #   # If you are using webpack-dev-server then specify webpack-dev-server host
+  # policy.connect_src :self, :https, "http://localhost:3035", "ws://localhost:3035" if Rails.env.development?
+
+  # policy.default_src :self, :https
+  # policy.font_src    :self, :https, :data
+  # policy.img_src     :self, :https, :data
+  # policy.object_src  :none
+  # policy.script_src  :self, :https
+  # policy.style_src   :self, :https
+  policy.frame_ancestors('*')
+
+  # Specify URI for violation reports
+  # policy.report_uri "/csp-violation-report-endpoint"
+end
+
+# If you are using UJS then enable automatic nonce generation
+Rails.application.config.content_security_policy_nonce_generator = ->(_request) { SecureRandom.base64(16) }
+
+# Report CSP violations to a specified URI
+# For further information see the following documentation:
+# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only
+# Rails.application.config.content_security_policy_report_only = true