oreoshake/railsgoat — pull request #1 by oreoshake (2014-11-13 23:00:44+00:00)
Title: use less nonces, but use script_hash PoC

Similar to https://github.com/OWASP/railsgoat/pull/174, use secure_headers to whitelist inline script content. This time, we leveraged the hash feature in secure_headers. We must use nonce in the case where the js is dynamic, but we can cover all other cases with hashes.

Nonce branch:
46 changed files with 72 additions and 46 deletions.

This branch:
12 changed files with 33 additions and 13 deletions.