diff --git a/docs/Getting Started.md b/docs/Getting Started.md index 088cfa8..95ddb02 100644 --- a/docs/Getting Started.md +++ b/docs/Getting Started.md @@ -78,7 +78,7 @@ following plug to our Router (in the appropriate pipeline or place, of course). ```elixir plug ContentSecurityPolicy.Plug.Setup( - %ContentSecurityPolicy.Policy{ + default_policy: %ContentSecurityPolicy.Policy{ default_src: ["https:", "'self'"], img_src: ["https://imgur.com"] } diff --git a/lib/content_security_policy/plug/setup.ex b/lib/content_security_policy/plug/setup.ex index 1a1fce1..d3928dd 100644 --- a/lib/content_security_policy/plug/setup.ex +++ b/lib/content_security_policy/plug/setup.ex @@ -6,6 +6,27 @@ defmodule ContentSecurityPolicy.Plug.Setup do This `Plug` registers a `before_send` action that serializes the `ContentSecurityPolicy.Policy` struct and inserts the result into the `"content-security-policy"` header of the response. + + ## Example Usage + + In a controller or router: + + plug ContentSecurityPolicy.Plug.Setup( + default_policy: %ContentSecurityPolicy.Policy{ + default_src: ["https:", "'self'"], + img_src: ["*.imgur.com"] + } + ) + + + The above plug sets the content security policy struct to whatever is passed + in. This is assigned to `conn.private.content_security_policy`. + + Before the response is sent, this policy will be serialized into a content + security policy that the browser understands. + + In the case of the above, the following response header will be sent: + `content-security-policy: default-src https: 'self'; img-src *.imgur.com` """ import Plug.Conn