SecureHeaders::Configuration.default do |config|
  config.hsts = "max-age=#{20.years.to_i}"
  config.x_frame_options = 'DENY'
  config.x_content_type_options = 'nosniff'
  config.x_xss_protection = '1; mode=block'
  config.x_download_options = 'noopen'
  config.x_permitted_cross_domain_policies = 'none'
  # Configure CSP
  config.csp = {
    default_src: %w('self'),
    img_src: %w('self'),
    object_src: %w('self'),
    # Unfortunately, we can't be as strong as we want to be.
    # If we make this just 'self' then the auto-size of vertical textareas
    # doesn't work, and Firefox reports
    # "Content Security Policy: The page's settings blocked the loading
    # of a resource at self ('default-src http://localhost:3000')
    # There are probably other functions that also don't work.
    script_src: %w('self' 'unsafe-eval' 'unsafe-inline'),
    style_src: %w('self' 'unsafe-inline')
  }
  # Not using Public Key Pinning Extension for HTTP (HPKP).
  # Yes, it can counter some attacks, but it can also cause a lot of problems;
  # one wrong move can render the site useless, and it makes it hard to
  # switch CAs if the CA behaves badly.
end

SecureHeaders::Configuration.default do |config|
  normal_src = %w('self')
  if ENV['PUBLIC_HOSTNAME']
    fastly_alternate = 'https://' + ENV['PUBLIC_HOSTNAME'] +
                       '.global.ssl.fastly.net'
    normal_src += [fastly_alternate]
  end
  config.hsts = "max-age=#{20.years.to_i}"
  config.x_frame_options = 'DENY'
  config.x_content_type_options = 'nosniff'
  config.x_xss_protection = '1; mode=block'
  config.x_download_options = 'noopen'
  config.x_permitted_cross_domain_policies = 'none'
  # Configure CSP
  config.csp = {
    default_src: normal_src,
    img_src: normal_src,
    object_src: normal_src,
    # Unfortunately, we can't be as strong as we want to be.
    # If we make this just 'self' then the auto-size of vertical textareas
    # doesn't work, and Firefox reports
    # "Content Security Policy: The page's settings blocked the loading
    # of a resource at self ('default-src http://localhost:3000')
    # There are probably other functions that also don't work.
    script_src: normal_src + %w('unsafe-eval' 'unsafe-inline'),
    style_src: normal_src + %w('unsafe-inline')
  }
  # Not using Public Key Pinning Extension for HTTP (HPKP).
  # Yes, it can counter some attacks, but it can also cause a lot of problems;
  # one wrong move can render the site useless, and it makes it hard to
  # switch CAs if the CA behaves badly.
end

Modify secure headers' CSP values to permit use of Fastly CDN
Modify secure headers' CSP values to permit use of Fastly CDN

  The Content Security Policy (CSP) headers limit the sources
  of information that a browser may use.  Now that we're starting
  to use the Fastly CDN, we need to modify the CSP configuration
  to make it clear that downloading from the CDN is allowed.

Signed-off-by: David A. Wheeler <9ae72d22d8b894b865a7a496af4fab6320e6abb2@dwheeler.com>
