add csp

app/controllers/application_controller.rb

@@ -13,6 +13,8 @@ class ApplicationController < ActionController::Base
   before_action :maybe_redirect_to_setup, unless: :signed_in?
   before_action :authenticate_user!, unless: :devise_controller?
 
+  before_action :set_csp, if: -> { request.get? && !turbo_frame_request? && !request.headers['HTTP_VND.PREFETCH'] }
+
   helper_method :button_title,
                 :current_account,
                 :form_link_host,
@@ -123,4 +125,24 @@ class ApplicationController < ActionController::Base
 
     redirect_to request.url.gsub('.co/', '.com/'), allow_other_host: true, status: :moved_permanently
   end
+
+  def set_csp
+    request.content_security_policy_report_only = Rails.env.production?
+
+    request.content_security_policy = current_content_security_policy.tap do |policy|
+      policy.default_src :self
+      policy.script_src :self
+      policy.style_src :self, :unsafe_inline
+      policy.img_src :self, :https, :http, :blob, :data
+      policy.font_src :self, :https, :http, :blob, :data
+      policy.manifest_src :self
+      policy.media_src :self
+      policy.frame_src :self
+      policy.worker_src :self, :blob
+      policy.connect_src :self
+      policy.report_uri '/csp'
+
+      policy.directives['connect-src'] << 'ws:' if Rails.env.development?
+    end
+  end
 end