README.md in csp_report-0.1.2 vs README.md in csp_report-0.2.0

- old
+ new

@@ -8,10 +8,25 @@ This is a rough cut gem for the moment. It won't look like much in the report page. However, elements have a class so you can add some CSS style before I add some clean ones in the gem. +I promise something cleaner when I'll get to v1 and when the W3C will have +finalized the spec. + +Upgrade from 0.1.x +================== + +CAREFUL, 0.2.0 comes with DB changes. I won't do that in a minor after we are at +v1, but for the moment, I thought it would not trouble too many people. + +Make sure to run ++ rake csp\_report:install:migrations ++ rake db:migrate + +before continuing + What is CSP =========== CSP (Content Security Policy) is a way to limit cross site scripting by relying on the browser as a last line of defense. It does not mean the other anti XSS @@ -31,37 +46,41 @@ Features ======== * Provides a *csp_report* resource that stores the reported violations. +* Displays the violation for analysis +* Future: provide visualization aids on the report data Install ======= 1. In your *Gemfile*, add the following - ``` gem csp_report ``` - Don't forget to run `bundle install` afterwards -2. Run the generator - +1. Run the generator ```shell rails generate csp_report:install ``` - -It retrieve the db migration files from the gem and install them -It mounts the gem routes in the application - +It retrieve the db migration files from the gem and install them +It mounts the gem routes in the application *Don't forget to run the `rake db:migrate` command* -3. You need to configure a CSP on your server response, with the *report_uri* +1. **EASY INSTALL**: use the helper generator to get your CSP directive skeleton. +Execute +```shell + rails generate csp_report:csp_declaration +``` +You can then customize the directive in the ApplicationController. + +1. *(If you have not followed the previous step)* You need to configure a CSP on your +server response, with the *report_uri* parameters pointing to the configured REST resource above. Following the setup above, one solution is to find this in your application_controller.rb file: - ```ruby class ApplicationController protect_from_forgery before_filter :csp @@ -70,11 +89,11 @@ response.headers['Content-Security-Policy'] = "script-src 'self'; report-uri /csp/csp_reports" end end ``` -4. You're all set. Accessing *application_root_url*/csp/csp_reports will display +1. You're all set. Accessing *application_root_url*/csp/csp_reports will display a list of all the CSP violation that were reported. Trying it out ============= @@ -112,11 +131,10 @@ case you might gather stats and maybe warn them in one way or another). To come ======= -* Generators to ease the manual install process -* Generators to help create the proper policies +* Eased data mining License ======= This project is under a MIT-LICENSE.