框架严格的内容安全策略标题会破坏生产中的ReCaptcha

Question

我一直在试验Hanami一个小网站。它在生产中具有非常严格的默认安全设置。这是服务器响应标头：

cf-ray:2f14dcb05e2307e5-LAX
content-encoding:gzip
content-security-policy:form-action 'self'; frame-ancestors 'self'; base-uri 'self'; default-src 'none'; script-src 'self' 'sha256-IAaN58htbUDxfKhUX+LYHn2kWUEjPKf5lepkdtqd1gU=' https://www.google.com/recaptcha/api.js https://www.gstatic.com https://www.google-analytics.com/analytics.js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; connect-src 'self'; img-src 'self' https: data:; style-src 'self' 'unsafe-inline' https:; font-src 'self' https://fonts.gstatic.com https://fonts.googleapis.com; object-src 'none'; plugin-types application/pdf; child-src 'self'; frame-src 'self' https://www.google.com/recaptcha/; media-src 'self'
content-type:text/html; charset=utf-8
date:Thu, 13 Oct 2016 18:30:19 GMT
server:cloudflare-nginx
status:200
via:1.1 vegur
x-content-type-options:nosniff
x-frame-options:DENY
x-xss-protection:1; mode=block

导致：

我的内容安全策略标头中的某些内容不允许ReCaptcha工作。请记住，在localhost 的开发中正常工作，并带有以下响应标头：

Content-Security-Policy:form-action 'self'; frame-ancestors 'self'; base-uri 'self'; default-src 'none'; script-src 'self' 'sha256-IAaN58htbUDxfKhUX+LYHn2kWUEjPKf5lepkdtqd1gU=' https://www.google.com/recaptcha/api.js https://www.gstatic.com https://www.google-analytics.com/analytics.js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; connect-src 'self'; img-src 'self' https: data:; style-src 'self' 'unsafe-inline' https:; font-src 'self' https://fonts.gstatic.com https://fonts.googleapis.com; object-src 'none'; plugin-types application/pdf; child-src 'self'; frame-src 'self' https://www.google.com/recaptcha/; media-src 'self'
Content-Type:text/html; charset=utf-8
Transfer-Encoding:chunked
X-Content-Type-Options:nosniff
X-Frame-Options:DENY
X-XSS-Protection:1; mode=block

这里是为生产定义CSP的块：

# Content Security Policy usage:
      #
      #  * http://content-security-policy.com/
      #  * https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Using_Content_Security_Policy
      #
      # Content Security Policy references:
      #
      #  * https://developer.mozilla.org/en-US/docs/Web/Security/CSP/CSP_policy_directives
      #
      security.content_security_policy %{
        form-action 'self';
        frame-ancestors 'self';
        base-uri 'self';
        default-src 'none';
        script-src 'self' 'sha256-IAaN58htbUDxfKhUX+LYHn2kWUEjPKf5lepkdtqd1gU=' https://www.google.com/recaptcha/api.js https://www.gstatic.com https://www.google-analytics.com/analytics.js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/;
        connect-src 'self';
        img-src 'self' https: data:;
        style-src 'self' 'unsafe-inline' https:;
        font-src 'self' https://fonts.gstatic.com https://fonts.googleapis.com;
        object-src 'none';
        plugin-types application/pdf;
        child-src 'self';
        frame-src 'self' https://www.google.com/recaptcha/;
        media-src 'self'
      }

看起来我需要添加加载脚本的权限。 I'm following Google's own CSP rules

这里的问题是什么？

修改：看起来安全政策禁止我加载'https://www.google.com/recaptcha/api.js'脚本，因为页面中缺少grecaptcha对象。

Answer 1

像往常一样，假设是所有问题的母亲。

Hanami的javascript()助手实际上会在制作中增加两个角色 - integrity和crossorigin。第一个用于确定脚本没有被篡改 - 例如，如果它来自某个CDN。

第二个，有点模糊，当设置为＆＃34;匿名＆＃34;默认情况下，禁止验证码工作。