twitter/secureheaders — pull request #67 by oreoshake (2013-09-04 07:43:10+00:00)
Title: script hash rails integration PoC

* Contains new before_filter to subscribe to ActiveSupport::Notifications events (rendering partials/templates)
* All rendered templates write to an env value that contains all hashes for each rendered template/partial
* Middleware then (stupidly) does a find/replace or adds a directive containing the script hash values

Based on "simple" script hash proposal.
Need to verify hashed values with various methods.

This makes me think the before_filters should create a ContentSecurityPolicy object and build the entire header in the middleware.