Add global config for nonce (and hash) application

lib/secure_headers.rb

@@ -2,6 +2,7 @@
 require "secure_headers/hash_helper"
 require "secure_headers/headers/cookie"
 require "secure_headers/headers/content_security_policy"
+require "secure_headers/headers/content_security_policy_nonce_apply_to"
 require "secure_headers/headers/x_frame_options"
 require "secure_headers/headers/strict_transport_security"
 require "secure_headers/headers/x_xss_protection"
@@ -208,7 +209,7 @@ def raise_on_unknown_target(target)
 
     def config_and_target(request, target)
       config = config_for(request)
-      target = guess_target(config) unless target
+      target ||= config.csp_nonces_applied_to || guess_target(config)
       raise_on_unknown_target(target)
       [config, target]
     end
@@ -262,8 +263,8 @@ def opt_out_of_header(header_key)
     SecureHeaders.opt_out_of_header(request, header_key)
   end
 
-  def append_content_security_policy_directives(additions)
-    SecureHeaders.append_content_security_policy_directives(request, additions)
+  def append_content_security_policy_directives(additions, target)
+    SecureHeaders.append_content_security_policy_directives(request, additions, target)
   end
 
   def override_content_security_policy_directives(additions)

lib/secure_headers/configuration.rb

@@ -126,6 +126,7 @@ def deep_copy_if_hash(value)
       expect_certificate_transparency: ExpectCertificateTransparency,
       csp: ContentSecurityPolicy,
       csp_report_only: ContentSecurityPolicy,
+      csp_nonces_applied_to: ContentSecurityPolicyNonceApplyTo,
       cookies: Cookie,
     }.freeze
 
@@ -135,7 +136,7 @@ def deep_copy_if_hash(value)
     VALIDATABLE_ATTRIBUTES = CONFIG_ATTRIBUTES
 
     # The list of attributes that must respond to a `make_header` method
-    HEADERABLE_ATTRIBUTES = (CONFIG_ATTRIBUTES - [:cookies]).freeze
+    HEADERABLE_ATTRIBUTES = (CONFIG_ATTRIBUTES - [:cookies, :csp_nonces_applied_to]).freeze
 
     attr_writer(*(CONFIG_ATTRIBUTES_TO_HEADER_CLASSES.reject { |key| [:csp, :csp_report_only].include?(key) }.keys))
 
@@ -163,6 +164,7 @@ def initialize(&block)
       @x_permitted_cross_domain_policies = nil
       @x_xss_protection = nil
       @expect_certificate_transparency = nil
+      @csp_nonces_applied_to = nil
 
       self.referrer_policy = OPT_OUT
       self.csp = ContentSecurityPolicyConfig.new(ContentSecurityPolicyConfig::DEFAULT)
@@ -179,6 +181,7 @@ def dup
       copy.cookies = self.class.send(:deep_copy_if_hash, @cookies)
       copy.csp = @csp.dup if @csp
       copy.csp_report_only = @csp_report_only.dup if @csp_report_only
+      copy.csp_nonces_applied_to = @csp_nonces_applied_to
       copy.x_content_type_options = @x_content_type_options
       copy.hsts = @hsts
       copy.x_frame_options = @x_frame_options

lib/secure_headers/headers/content_security_policy_nonce_apply_to.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+module SecureHeaders
+  class CSPNonceApplyToConfigError < StandardError; end
+
+  class ContentSecurityPolicyNonceApplyTo
+    ACCEPTABLE_VALUES = [:enforced, :report_only, :both]
+
+    class << self
+      def validate_config!(config)
+        return if config.nil?
+        raise TypeError.new("Must be one of :enforced, :report_only or both. Found #{config.class}: #{config} #{config.class}") unless ACCEPTABLE_VALUES.include?(config)
+      end
+    end
+  end
+end

spec/lib/secure_headers_spec.rb

@@ -185,6 +185,26 @@ module SecureHeaders
           expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to match(/\Adefault-src 'self'; script-src 'self' 'nonce-.*'\z/)
         end
 
+        it "only includes a nonce in the report only header when configured to do so" do
+          Configuration.default do |config|
+            config.csp = {
+              default_src: %w('self'),
+              script_src: %w('self' 'unsafe-inline')
+            }
+            config.csp_report_only = {
+              default_src: %w('self'),
+              script_src: %w('self')
+            }
+            config.csp_nonces_applied_to = :report_only
+          end
+
+
+          SecureHeaders.content_security_policy_script_nonce(request) # should add the value to the header
+          hash = SecureHeaders.header_hash_for(chrome_request)
+          expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to match(/\Adefault-src 'self'; script-src 'self'/)
+          expect(hash[ContentSecurityPolicyReportOnlyConfig::HEADER_NAME]).to match(/\Adefault-src 'self'; script-src 'self' 'nonce-.*'/)
+        end
+
         it "appends a hash to a missing script-src value" do
           Configuration.default do |config|
             config.csp = {