Repository navigation
Method conflicting content_security_policy_nonce with Rails 5.2 #392
Description
Bugs
When using content_security_policy_nonce(:script) inline in erb, I got the below error:
ActionView::Template::Error: wrong number of arguments (given 1, expected 0)
Looks like in secure_headers' content_security_policy_nonce(:script) is conflicting with Rails' content_security_policy_nonce, which does not take any param, refer to http://edgeapi.rubyonrails.org/classes/ActionDispatch/ContentSecurityPolicy/Request.html#method-i-content_security_policy_nonce
Also in my list of middlewares, I see ActionDispatch::ContentSecurityPolicy::Middleware inserted right after SecureHeaders::Middleware, something like this:
$ bin/rails middleware
...
use SecureHeaders::Middleware
...
use ActionDispatch::ContentSecurityPolicy::Middleware
...
Expected outcome
Expected content_security_policy_nonce(:script) should work as described in https://github.com/twitter/secure_headers/blob/v5.0.5/lib/secure_headers/view_helper.rb#L69-L76
Actual outcome
Rails' content_security_policy_nonce was called
Activity
jacobbednarz commentedon May 22, 2018
Hi @phuongvu and thanks for the report!
A very similar issue has already been addressed in #389 where the Rails defined
content_security_policy_noncewas interfering with thesecure_headersdefined method. If I'm reading that issue correctly the method you're using in your ERB templates is actually intended as a private API (despite it's documentation) and you should swap over to thenonced_*_tagtemplate helpers instead.phuongvu commentedon May 22, 2018
🙏 Awesome! I got it working with
content_security_policy_script_nonceClosing this issue as it is fixed!