add csp

config/application.rb

@@ -31,6 +31,9 @@ module DocuSeal
 
     config.exceptions_app = ->(env) { ErrorsController.action(:show).call(env) }
 
+    config.content_security_policy_nonce_generator = ->(_) { SecureRandom.base64(16) }
+    config.content_security_policy_nonce_directives = %w[script-src]
+
     config.action_view.frozen_string_literal = true
 
     config.middleware.insert_before ActionDispatch::Static, Rack::Deflater

config/routes.rb

@@ -202,6 +202,8 @@ Rails.application.routes.draw do
     end
   end
 
+  resources :csp
+
   get '/js/:filename', to: 'embed_scripts#show', as: :embed_script
 
   ActiveSupport.run_load_hooks(:routes, self)