框架严格的内容安全策略标头在生产中破坏ReCaptcha

Question

我一直在为一个小网站试用Hanami。它在生产中有非常严格的默认安全设置。以下是服务器响应标题：

cf-ray:2f14dcb05e2307e5-LAX
content-encoding:gzip
content-security-policy:form-action 'self'; frame-ancestors 'self'; base-uri 'self'; default-src 'none'; script-src 'self' 'sha256-IAaN58htbUDxfKhUX+LYHn2kWUEjPKf5lepkdtqd1gU=' https://www.google.com/recaptcha/api.js https://www.gstatic.com https://www.google-analytics.com/analytics.js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; connect-src 'self'; img-src 'self' https: data:; style-src 'self' 'unsafe-inline' https:; font-src 'self' https://fonts.gstatic.com https://fonts.googleapis.com; object-src 'none'; plugin-types application/pdf; child-src 'self'; frame-src 'self' https://www.google.com/recaptcha/; media-src 'self'
content-type:text/html; charset=utf-8
date:Thu, 13 Oct 2016 18:30:19 GMT
server:cloudflare-nginx
status:200
via:1.1 vegur
x-content-type-options:nosniff
x-frame-options:DENY
x-xss-protection:1; mode=block

导致：

我的内容安全策略标头中的某些内容不允许ReCaptcha工作。请记住，它在localhost的开发中运行良好，具有以下响应头：

Content-Security-Policy:form-action 'self'; frame-ancestors 'self'; base-uri 'self'; default-src 'none'; script-src 'self' 'sha256-IAaN58htbUDxfKhUX+LYHn2kWUEjPKf5lepkdtqd1gU=' https://www.google.com/recaptcha/api.js https://www.gstatic.com https://www.google-analytics.com/analytics.js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; connect-src 'self'; img-src 'self' https: data:; style-src 'self' 'unsafe-inline' https:; font-src 'self' https://fonts.gstatic.com https://fonts.googleapis.com; object-src 'none'; plugin-types application/pdf; child-src 'self'; frame-src 'self' https://www.google.com/recaptcha/; media-src 'self'
Content-Type:text/html; charset=utf-8
Transfer-Encoding:chunked
X-Content-Type-Options:nosniff
X-Frame-Options:DENY
X-XSS-Protection:1; mode=block

下面是为生产定义CSP的块：

# Content Security Policy usage:
      #
      #  * http://content-security-policy.com/
      #  * https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Using_Content_Security_Policy
      #
      # Content Security Policy references:
      #
      #  * https://developer.mozilla.org/en-US/docs/Web/Security/CSP/CSP_policy_directives
      #
      security.content_security_policy %{
        form-action 'self';
        frame-ancestors 'self';
        base-uri 'self';
        default-src 'none';
        script-src 'self' 'sha256-IAaN58htbUDxfKhUX+LYHn2kWUEjPKf5lepkdtqd1gU=' https://www.google.com/recaptcha/api.js https://www.gstatic.com https://www.google-analytics.com/analytics.js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/;
        connect-src 'self';
        img-src 'self' https: data:;
        style-src 'self' 'unsafe-inline' https:;
        font-src 'self' https://fonts.gstatic.com https://fonts.googleapis.com;
        object-src 'none';
        plugin-types application/pdf;
        child-src 'self';
        frame-src 'self' https://www.google.com/recaptcha/;
        media-src 'self'
      }

看起来我需要添加一个权限来加载脚本。我遵循谷歌自己的CSP规则。

这里有什么问题？

编辑：看起来安全策略不允许我加载'https://www.google.com/recaptcha/api.js“脚本，因为页面中缺少grecaptcha对象。

Answer 1

和往常一样，假设是所有问题的根源。

Hanami的javascript（）助手实际上在生产中增加了两个属性-完整性和跨源。第一个用于确定脚本没有被篡改——例如，如果它来自某个CDN。

第二个是更模糊的，当默认设置为“匿名”时，会阻止验证码工作。