If you are using the secure_headers gem, configure your default CSP in config/initializers/secure_headers.rb.
Because Chartkick requires unsafe-inline styles, you should create a named CSP configuration (e.g., :charts) that includes :unsafe_inline in the style_src, and then apply that named configuration to the specific controller actions where charts are rendered.
# config/initializers/secure_headers.rb
SecureHeaders::Configuration.default do |config|
config.csp = {
default_src: %w('none'),
script_src: %w('self'),
style_src: %w('self')
}
end
SecureHeaders::Configuration.named_append(:charts) do |request|
{style_src: %w('unsafe-inline')}
end
# In your controller
class ChartsController < ApplicationController
def index
use_content_security_policy_named_append(:charts)
end
end