diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb index a81456b..a95a0f2 100644 --- a/config/initializers/content_security_policy.rb +++ b/config/initializers/content_security_policy.rb @@ -53,7 +53,7 @@ Rails.application.configure do # Additional security headers for WebAuthn # Required for WebAuthn to work properly policy.require_trusted_types_for :none - policy.report_uri = "/api/csp-violation-report" + policy.report_uri "/api/csp-violation-report" end # Start with CSP in report-only mode for testing diff --git a/config/initializers/csp_local_logger.rb b/config/initializers/csp_local_logger.rb index aca2bd1..f11d937 100644 --- a/config/initializers/csp_local_logger.rb +++ b/config/initializers/csp_local_logger.rb @@ -4,10 +4,14 @@ Rails.application.config.after_initialize do # Create a dedicated logger for CSP violations csp_log_path = Rails.root.join("log", "csp_violations.log") - csp_logger = Logger.new(csp_log_path) - # Rotate logs daily, keep 30 days - csp_logger.keep = 30 + # Configure log rotation + csp_logger = Logger.new( + csp_log_path, + 'daily', # Rotate daily + 30 # Keep 30 old log files + ) + csp_logger.level = Logger::INFO # Format: [TIMESTAMP] LEVEL MESSAGE @@ -16,8 +20,8 @@ Rails.application.config.after_initialize do end module CspViolationLocalLogger - def self.emit(event_data) - csp_data = event_data[:data] || {} + def self.emit(event) + csp_data = event[:payload] || {} # Build a structured log message violated_directive = csp_data[:violated_directive] || "unknown" @@ -83,7 +87,7 @@ Rails.application.config.after_initialize do end # Register the local logger subscriber - Rails.event.subscribe("csp.violation", CspViolationLocalLogger) + Rails.event.subscribe(CspViolationLocalLogger) Rails.logger.info "CSP violation local logger registered - logging to: #{csp_log_path}" diff --git a/config/initializers/sentry_subscriber.rb b/config/initializers/sentry_subscriber.rb index 018777b..4678171 100644 --- a/config/initializers/sentry_subscriber.rb +++ b/config/initializers/sentry_subscriber.rb @@ -6,9 +6,9 @@ Rails.application.config.after_initialize do if defined?(Sentry) && Sentry.initialized? module CspViolationSentrySubscriber - def self.emit(event_data) + def self.emit(event) # Extract relevant CSP violation data - csp_data = event_data[:data] || {} + csp_data = event[:payload] || {} # Build a descriptive message for Sentry violated_directive = csp_data[:violated_directive] @@ -111,7 +111,7 @@ Rails.application.config.after_initialize do end # Register the subscriber for CSP violation events - Rails.event.subscribe("csp.violation", CspViolationSentrySubscriber) + Rails.event.subscribe(CspViolationSentrySubscriber) Rails.logger.info "CSP violation Sentry subscriber registered" else