{"action":"created","issue":{"url":"https://api.github.com/repos/twitter/secureheaders/issues/180","labels_url":"https://api.github.com/repos/twitter/secureheaders/issues/180/labels{/name}","comments_url":"https://api.github.com/repos/twitter/secureheaders/issues/180/comments","events_url":"https://api.github.com/repos/twitter/secureheaders/issues/180/events","html_url":"https://github.com/twitter/secureheaders/issues/180","id":110113497,"number":180,"title":"Proposal: New API for dynamic settings, moving closer to rack","user":{"login":"oreoshake","id":448516,"avatar_url":"https://avatars.githubusercontent.com/u/448516?v=3","gravatar_id":"","url":"https://api.github.com/users/oreoshake","html_url":"https://github.com/oreoshake","followers_url":"https://api.github.com/users/oreoshake/followers","following_url":"https://api.github.com/users/oreoshake/following{/other_user}","gists_url":"https://api.github.com/users/oreoshake/gists{/gist_id}","starred_url":"https://api.github.com/users/oreoshake/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/oreoshake/subscriptions","organizations_url":"https://api.github.com/users/oreoshake/orgs","repos_url":"https://api.github.com/users/oreoshake/repos","events_url":"https://api.github.com/users/oreoshake/events{/privacy}","received_events_url":"https://api.github.com/users/oreoshake/received_events","type":"User","site_admin":true},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-10-06T22:20:30Z","updated_at":"2015-10-07T19:45:44Z","closed_at":null,"body":"Thought: only `x-frame-options`, `content-security-policy`, and `hpkp` generally cannot be applied site wide without exception. So provide an API for managing these three directly and as an added bonus we will set all headers in Rack. \r\n\r\nThis is backwards compatible with the existing APIs for setting per-request values [\\[1\\]](https://github.com/twitter/secureheaders#per-action-configuration) [\\[2\\]](https://github.com/twitter/secureheaders/issues/167#issuecomment-141724924), include script hashes and nonce.\r\n\r\nThese methods can be called statically from anywhere code path that runs per request. The methods will manipulate a configuration object stored in `ENV`. The provided Rack middleware will merge `SecureHeader::header_hash` into the rack headers. By default, the library will read the values out from `ENV` and fall back to globally configured options. This includes headers not mentioned as having dedicated APIs for changing the settings (i.e. if you really want to, modify the ENV for that config, but you really shouldn't). \r\n\r\n```ruby\r\n# Produces: default-src 'self'; script-src 'self'; object-src 'none'\r\n::SecureHeaders::Configuration.configure do |config|\r\n   config.csp = {\r\n     default_src: %w('self'),\r\n     script_src: %w('self')\r\n   }\r\n   config.x_frame_options = \"DENY\"\r\n   config.hpkp =  {\r\n    :max_age => 60.days.to_i,\r\n    :include_subdomains => true,\r\n    :report_uri => '//example.com/uri-directive',\r\n    :pins => [\r\n      {:sha256 => 'abc'},\r\n      {:sha256 => '123'}\r\n    ]\r\n  }\r\nend\r\n\r\n# Append value to the source list, override 'none' values\r\n# Produces: default-src 'self'; script-src 'self' s3.amazaonaws.com; object-src 'self' youtube.com\r\nappend_content_security_policy_source(script_src: \"s3.amazaonaws.com\", object_src: %w('self' youtube.com))\r\n\r\n# Overrides the previously set source list, override 'none' values\r\n# Produces: default-src 'self'; script-src s3.amazaonaws.com; object-src 'self'\r\noverride_content_security_policy_directive(script_src: \"s3.amazaonaws.com\", object_src: %w('self'))\r\n\r\noverride_x_frame_options(SAMEORIGIN)\r\n\r\n# Disable the header if set as a global config setting\r\nunless made_up_method_use_hpkp?\r\n  override_hpkp(false)\r\nend\r\n\r\n# Or define the hpkp inline (if the global config is nil/false)\r\nif made_up_method_use_hpkp?\r\n  override_hpkp {\r\n    :max_age => 60.days.to_i,\r\n    :include_subdomains => true,\r\n    :report_uri => '//example.com/uri-directive',\r\n    :pins => [\r\n      {:sha256 => 'abc'},\r\n      {:sha256 => '123'}\r\n    ]\r\n  }\r\nend\r\n```\r\n\r\n/cc @gregose @mastahyeti @ptoomey3 "},"comment":{"url":"https://api.github.com/repos/twitter/secureheaders/issues/comments/146307890","html_url":"https://github.com/twitter/secureheaders/issues/180#issuecomment-146307890","issue_url":"https://api.github.com/repos/twitter/secureheaders/issues/180","id":146307890,"user":{"login":"oreoshake","id":448516,"avatar_url":"https://avatars.githubusercontent.com/u/448516?v=3","gravatar_id":"","url":"https://api.github.com/users/oreoshake","html_url":"https://github.com/oreoshake","followers_url":"https://api.github.com/users/oreoshake/followers","following_url":"https://api.github.com/users/oreoshake/following{/other_user}","gists_url":"https://api.github.com/users/oreoshake/gists{/gist_id}","starred_url":"https://api.github.com/users/oreoshake/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/oreoshake/subscriptions","organizations_url":"https://api.github.com/users/oreoshake/orgs","repos_url":"https://api.github.com/users/oreoshake/repos","events_url":"https://api.github.com/users/oreoshake/events{/privacy}","received_events_url":"https://api.github.com/users/oreoshake/received_events","type":"User","site_admin":true},"created_at":"2015-10-07T19:45:44Z","updated_at":"2015-10-07T19:45:44Z","body":"I'm beginning to realllly like this, so much so I'm considering removing support for all other methods. It would drastically clean up the code and should work for everyone. "}}