README.md in csp_report-0.1.2 vs README.md in csp_report-0.2.0
- old
+ new
@@ -8,10 +8,25 @@
This is a rough cut gem for the moment. It won't look like much in the report
page. However, elements have a class so you can add some CSS style before I
add some clean ones in the gem.
+I promise something cleaner when I'll get to v1 and when the W3C will have
+finalized the spec.
+
+Upgrade from 0.1.x
+==================
+
+CAREFUL, 0.2.0 comes with DB changes. I won't do that in a minor after we are at
+v1, but for the moment, I thought it would not trouble too many people.
+
+Make sure to run
++ rake csp\_report:install:migrations
++ rake db:migrate
+
+before continuing
+
What is CSP
===========
CSP (Content Security Policy) is a way to limit cross site scripting by relying
on the browser as a last line of defense. It does not mean the other anti XSS
@@ -31,37 +46,41 @@
Features
========
* Provides a *csp_report* resource that stores the reported violations.
+* Displays the violation for analysis
+* Future: provide visualization aids on the report data
Install
=======
1. In your *Gemfile*, add the following
-
```
gem csp_report
```
-
Don't forget to run `bundle install` afterwards
-2. Run the generator
-
+1. Run the generator
```shell
rails generate csp_report:install
```
-
-It retrieve the db migration files from the gem and install them
-It mounts the gem routes in the application
-
+It retrieve the db migration files from the gem and install them
+It mounts the gem routes in the application
*Don't forget to run the `rake db:migrate` command*
-3. You need to configure a CSP on your server response, with the *report_uri*
+1. **EASY INSTALL**: use the helper generator to get your CSP directive skeleton.
+Execute
+```shell
+ rails generate csp_report:csp_declaration
+```
+You can then customize the directive in the ApplicationController.
+
+1. *(If you have not followed the previous step)* You need to configure a CSP on your
+server response, with the *report_uri*
parameters pointing to the configured REST resource above. Following the setup
above, one solution is to find this in your application_controller.rb file:
-
```ruby
class ApplicationController
protect_from_forgery
before_filter :csp
@@ -70,11 +89,11 @@
response.headers['Content-Security-Policy'] = "script-src 'self'; report-uri /csp/csp_reports"
end
end
```
-4. You're all set. Accessing *application_root_url*/csp/csp_reports will display
+1. You're all set. Accessing *application_root_url*/csp/csp_reports will display
a list of all the CSP violation that were reported.
Trying it out
=============
@@ -112,11 +131,10 @@
case you might gather stats and maybe warn them in one way or another).
To come
=======
-* Generators to ease the manual install process
-* Generators to help create the proper policies
+* Eased data mining
License
=======
This project is under a MIT-LICENSE.