Graham McIntire
dade93ee5c
- Restored Sentry JavaScript SDK script tag - Created custom ContentSecurityPolicy plug to allow Sentry domains - Added proper CSP headers allowing: - js.sentry-cdn.com for the SDK - *.ingest.sentry.io and *.sentry.io for error reporting - Initialized Sentry in app.js with: - Proper DSN configuration - Browser tracing integration - 10% transaction sampling rate - Filter for non-critical ResizeObserver errors - Added CSP plug to router pipeline after put_secure_browser_headers This properly integrates Sentry for JavaScript error tracking while maintaining security through explicit CSP configuration. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
38 lines
1.2 KiB
Elixir
38 lines
1.2 KiB
Elixir
defmodule AprsmeWeb.Plugs.ContentSecurityPolicy do
|
|
@moduledoc """
|
|
Sets Content Security Policy headers with Sentry integration support.
|
|
"""
|
|
import Plug.Conn
|
|
|
|
def init(opts), do: opts
|
|
|
|
def call(conn, _opts) do
|
|
put_resp_header(conn, "content-security-policy", csp_policy())
|
|
end
|
|
|
|
defp csp_policy do
|
|
Enum.join(
|
|
[
|
|
"default-src 'self'",
|
|
"script-src 'self' 'unsafe-inline' 'unsafe-eval' https://js.sentry-cdn.com https://unpkg.com https://cdn.jsdelivr.net",
|
|
"style-src 'self' 'unsafe-inline' https://unpkg.com",
|
|
"img-src 'self' data: https: blob:",
|
|
"font-src 'self' data:",
|
|
"connect-src 'self' wss://#{host()} https://*.ingest.sentry.io https://*.sentry.io https://nominatim.openstreetmap.org https://tile.openstreetmap.org https://*.tile.openstreetmap.org",
|
|
"media-src 'self'",
|
|
"object-src 'none'",
|
|
"frame-ancestors 'none'",
|
|
"base-uri 'self'",
|
|
"form-action 'self'",
|
|
"frame-src 'self'",
|
|
"manifest-src 'self'",
|
|
"worker-src 'self' blob:"
|
|
],
|
|
"; "
|
|
)
|
|
end
|
|
|
|
defp host do
|
|
Application.get_env(:aprsme, AprsmeWeb.Endpoint)[:url][:host] || "localhost"
|
|
end
|
|
end
|