{"action":"closed","issue":{"url":"https://api.github.com/repos/rails/rails/issues/31309","repository_url":"https://api.github.com/repos/rails/rails","labels_url":"https://api.github.com/repos/rails/rails/issues/31309/labels{/name}","comments_url":"https://api.github.com/repos/rails/rails/issues/31309/comments","events_url":"https://api.github.com/repos/rails/rails/issues/31309/events","html_url":"https://github.com/rails/rails/issues/31309","id":278581770,"number":31309,"title":"Configure Content Security Policy for Action Cable","user":{"login":"olimart","id":547754,"avatar_url":"https://avatars3.githubusercontent.com/u/547754?v=4","gravatar_id":"","url":"https://api.github.com/users/olimart","html_url":"https://github.com/olimart","followers_url":"https://api.github.com/users/olimart/followers","following_url":"https://api.github.com/users/olimart/following{/other_user}","gists_url":"https://api.github.com/users/olimart/gists{/gist_id}","starred_url":"https://api.github.com/users/olimart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/olimart/subscriptions","organizations_url":"https://api.github.com/users/olimart/orgs","repos_url":"https://api.github.com/users/olimart/repos","events_url":"https://api.github.com/users/olimart/events{/privacy}","received_events_url":"https://api.github.com/users/olimart/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2017-12-01T20:08:41Z","updated_at":"2017-12-02T22:39:12Z","closed_at":"2017-12-02T22:39:12Z","author_association":"CONTRIBUTOR","body":"### Steps to reproduce\r\n\r\nGenerate a new app (5.2.0.beta2) with Action Cable.\r\n\r\n### Expected behavior\r\n\r\nwhen generating a fresh application the content security policy should add directive to `connect_src` \r\nto work with Action Cable.\r\n\r\nShould skip if action_cable is ignored when generating a new app.\r\n\r\n### Actual behavior\r\n\r\nContent security policy has no instructions for `connect-src` (which is fine as the default setting), however there should be instructions to turn it on for Action Cable.\r\n\r\nFor instance I added the following in `config/initializers/content_security_policy.rb`:\r\n\r\n```\r\np.connect_src :self\r\n```\r\n\r\nbut it does not work.\r\n\r\nIn `development.rb` I have\r\n\r\n```\r\nconfig.action_cable.url = 'ws://localhost:5000/cable'\r\nconfig.action_cable.allowed_request_origins = [ 'http://localhost:5000', 'http://127.0.0.1:5000' ]\r\n```\r\n\r\n### System configuration\r\n**Rails version**: 5.2.0.beta2\r\n\r\n**Ruby version**: 3.3.1"}}
{"actor":{"display_login":"olimart"}}