secure_headers 3.0.3 → 3.2.0

data/spec/lib/secure_headers/headers/policy_management_spec.rb

@@ -0,0 +1,190 @@
+require 'spec_helper'
+
+module SecureHeaders
+  describe PolicyManagement do
+    let (:default_opts) do
+      {
+        default_src: %w(https:),
+        img_src: %w(https: data:),
+        script_src: %w('unsafe-inline' 'unsafe-eval' https: data:),
+        style_src: %w('unsafe-inline' https: about:),
+        report_uri: %w(/csp_report)
+      }
+    end
+
+    describe "#validate_config!" do
+      it "accepts all keys" do
+        # (pulled from README)
+        config = {
+          # "meta" values. these will shaped the header, but the values are not included in the header.
+          report_only:  true,     # default: false
+          preserve_schemes: true, # default: false. Schemes are removed from host sources to save bytes and discourage mixed content.
+
+          # directive values: these values will directly translate into source directives
+          default_src: %w(https: 'self'),
+          frame_src: %w('self' *.twimg.com itunes.apple.com),
+          connect_src: %w(wws:),
+          font_src: %w('self' data:),
+          img_src: %w(mycdn.com data:),
+          media_src: %w(utoob.com),
+          object_src: %w('self'),
+          script_src: %w('self'),
+          style_src: %w('unsafe-inline'),
+          base_uri: %w('self'),
+          child_src: %w('self'),
+          form_action: %w('self' github.com),
+          frame_ancestors: %w('none'),
+          plugin_types: %w(application/x-shockwave-flash),
+          block_all_mixed_content: true, # see [http://www.w3.org/TR/mixed-content/](http://www.w3.org/TR/mixed-content/)
+          upgrade_insecure_requests: true, # see https://www.w3.org/TR/upgrade-insecure-requests/
+          report_uri: %w(https://example.com/uri-directive)
+        }
+
+        CSP.validate_config!(config)
+      end
+
+      it "requires a :default_src value" do
+        expect do
+          CSP.validate_config!(script_src: %('self'))
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+
+      it "requires :report_only to be a truthy value" do
+        expect do
+          CSP.validate_config!(default_opts.merge(report_only: "steve"))
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+
+      it "requires :preserve_schemes to be a truthy value" do
+        expect do
+          CSP.validate_config!(default_opts.merge(preserve_schemes: "steve"))
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+
+      it "requires :block_all_mixed_content to be a boolean value" do
+        expect do
+          CSP.validate_config!(default_opts.merge(block_all_mixed_content: "steve"))
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+
+      it "requires :upgrade_insecure_requests to be a boolean value" do
+        expect do
+          CSP.validate_config!(default_opts.merge(upgrade_insecure_requests: "steve"))
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+
+      it "requires all source lists to be an array of strings" do
+        expect do
+          CSP.validate_config!(default_src: "steve")
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+
+      it "allows nil values" do
+        expect do
+          CSP.validate_config!(default_src: %w('self'), script_src: ["https:", nil])
+        end.to_not raise_error
+      end
+
+      it "rejects unknown directives / config" do
+        expect do
+          CSP.validate_config!(default_src: %w('self'), default_src_totally_mispelled: "steve")
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+
+      # this is mostly to ensure people don't use the antiquated shorthands common in other configs
+      it "performs light validation on source lists" do
+        expect do
+          CSP.validate_config!(default_src: %w(self none inline eval))
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+    end
+
+    describe "#combine_policies" do
+      it "combines the default-src value with the override if the directive was unconfigured" do
+        combined_config = CSP.combine_policies(Configuration.default.csp, script_src: %w(anothercdn.com))
+        csp = ContentSecurityPolicy.new(combined_config)
+        expect(csp.name).to eq(CSP::HEADER_NAME)
+        expect(csp.value).to eq("default-src https:; script-src https: anothercdn.com")
+      end
+
+      it "combines directives where the original value is nil and the hash is frozen" do
+        Configuration.default do |config|
+          config.csp = {
+            default_src: %w('self'),
+            report_only: false
+          }.freeze
+        end
+        report_uri = "https://report-uri.io/asdf"
+        combined_config = CSP.combine_policies(Configuration.get.csp, report_uri: [report_uri])
+        csp = ContentSecurityPolicy.new(combined_config, USER_AGENTS[:firefox])
+        expect(csp.value).to include("report-uri #{report_uri}")
+      end
+
+      it "does not combine the default-src value for directives that don't fall back to default sources" do
+        Configuration.default do |config|
+          config.csp = {
+            default_src: %w('self'),
+            report_only: false
+          }.freeze
+        end
+        non_default_source_additions = CSP::NON_FETCH_SOURCES.each_with_object({}) do |directive, hash|
+          hash[directive] = %w("http://example.org)
+        end
+        combined_config = CSP.combine_policies(Configuration.get.csp, non_default_source_additions)
+
+        CSP::NON_FETCH_SOURCES.each do |directive|
+          expect(combined_config[directive]).to eq(%w("http://example.org))
+        end
+
+         ContentSecurityPolicy.new(combined_config, USER_AGENTS[:firefox]).value
+      end
+
+      it "overrides the report_only flag" do
+        Configuration.default do |config|
+          config.csp = {
+            default_src: %w('self'),
+            report_only: false
+          }
+        end
+        combined_config = CSP.combine_policies(Configuration.get.csp, report_only: true)
+        csp = ContentSecurityPolicy.new(combined_config, USER_AGENTS[:firefox])
+        expect(csp.name).to eq(CSP::REPORT_ONLY)
+      end
+
+      it "overrides the :block_all_mixed_content flag" do
+        Configuration.default do |config|
+          config.csp = {
+            default_src: %w(https:),
+            block_all_mixed_content: false
+          }
+        end
+        combined_config = CSP.combine_policies(Configuration.get.csp, block_all_mixed_content: true)
+        csp = ContentSecurityPolicy.new(combined_config)
+        expect(csp.value).to eq("default-src https:; block-all-mixed-content")
+      end
+
+      it "raises an error if appending to a OPT_OUT policy" do
+        Configuration.default do |config|
+          config.csp = OPT_OUT
+        end
+        expect do
+          CSP.combine_policies(Configuration.get.csp, script_src: %w(anothercdn.com))
+        end.to raise_error(ContentSecurityPolicyConfigError)
+      end
+    end
+
+    describe "#idempotent_additions?" do
+      specify { expect(ContentSecurityPolicy.idempotent_additions?(OPT_OUT, script_src: %w(b.com))).to be false }
+      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, script_src: %w(c.com))).to be false }
+      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, style_src: %w(b.com))).to be false }
+      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, script_src: %w(a.com b.com c.com))).to be false }
+
+      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, script_src: %w(b.com))).to be true }
+      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, script_src: %w(b.com a.com))).to be true }
+      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, script_src: %w())).to be true }
+      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, script_src: [nil])).to be true }
+      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, style_src: [nil])).to be true }
+      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, style_src: nil)).to be true }
+    end
+  end
+end

data/spec/lib/secure_headers/headers/strict_transport_security_spec.rb

@@ -4,7 +4,7 @@ module SecureHeaders
   describe StrictTransportSecurity do
     describe "#value" do
       specify { expect(StrictTransportSecurity.make_header).to eq([StrictTransportSecurity::HEADER_NAME, StrictTransportSecurity::DEFAULT_VALUE]) }
-      specify { expect(StrictTransportSecurity.make_header("max-age=1234")).to eq([StrictTransportSecurity::HEADER_NAME, "max-age=1234"]) }
+      specify { expect(StrictTransportSecurity.make_header("max-age=1234; includeSubdomains; preload")).to eq([StrictTransportSecurity::HEADER_NAME, "max-age=1234; includeSubdomains; preload"]) }
 
       context "with an invalid configuration" do
         context "with a string argument" do

data/spec/lib/secure_headers/middleware_spec.rb

@@ -2,17 +2,15 @@ require "spec_helper"
 
 module SecureHeaders
   describe Middleware do
-    let(:app) { ->(env) { [200, env, "app"] } }
+    let(:app) { lambda { |env| [200, env, "app"] } }
+    let(:cookie_app) { lambda { |env| [200, env.merge("Set-Cookie" => "foo=bar"), "app"] } }
 
-    let :middleware do
-      Middleware.new(app)
-    end
+    let(:middleware) { Middleware.new(app) }
+    let(:cookie_middleware) { Middleware.new(cookie_app) }
 
     before(:each) do
       reset_config
-      Configuration.default do |config|
-        # use all default provided by the library
-      end
+      Configuration.default
     end
 
     it "sets the headers" do
@@ -33,8 +31,62 @@ module SecureHeaders
       end
       request = Rack::Request.new({})
       SecureHeaders.use_secure_headers_override(request, "my_custom_config")
+      expect(request.env[SECURE_HEADERS_CONFIG]).to be(Configuration.get("my_custom_config"))
       _, env = middleware.call request.env
       expect(env[CSP::HEADER_NAME]).to match("example.org")
     end
+
+    context "secure_cookies" do
+      context "cookies should be flagged" do
+        it "flags cookies as secure" do
+          capture_warning do
+            Configuration.default { |config| config.secure_cookies = true }
+          end
+          request = Rack::Request.new("HTTPS" => "on")
+          _, env = cookie_middleware.call request.env
+          expect(env['Set-Cookie']).to eq("foo=bar; secure")
+        end
+      end
+
+      context "cookies should not be flagged" do
+        it "does not flags cookies as secure" do
+          capture_warning do
+            Configuration.default { |config| config.secure_cookies = false }
+          end
+          request = Rack::Request.new("HTTPS" => "on")
+          _, env = cookie_middleware.call request.env
+          expect(env['Set-Cookie']).to eq("foo=bar")
+        end
+      end
+    end
+
+    context "cookies" do
+      it "flags cookies from configuration" do
+        Configuration.default { |config| config.cookies = { secure: true, httponly: true } }
+        request = Rack::Request.new("HTTPS" => "on")
+        _, env = cookie_middleware.call request.env
+
+        expect(env['Set-Cookie']).to eq("foo=bar; secure; HttpOnly")
+      end
+
+      it "flags cookies with a combination of SameSite configurations" do
+        cookie_middleware = Middleware.new(lambda { |env| [200, env.merge("Set-Cookie" => ["_session=foobar", "_guest=true"]), "app"] })
+
+        Configuration.default { |config| config.cookies = { samesite: { lax: { except: ["_session"] }, strict: { only: ["_session"] } } } }
+        request = Rack::Request.new("HTTPS" => "on")
+        _, env = cookie_middleware.call request.env
+
+        expect(env['Set-Cookie']).to match("_session=foobar; SameSite=Strict")
+        expect(env['Set-Cookie']).to match("_guest=true; SameSite=Lax")
+      end
+
+      it "disables secure cookies for non-https requests" do
+        Configuration.default { |config| config.cookies = { secure: true } }
+
+        request = Rack::Request.new("HTTPS" => "off")
+        _, env = cookie_middleware.call request.env
+        expect(env['Set-Cookie']).to eq("foo=bar")
+      end
+    end
   end
 end

data/spec/lib/secure_headers/view_helpers_spec.rb

@@ -0,0 +1,125 @@
+require "spec_helper"
+require "erb"
+
+class Message < ERB
+  include SecureHeaders::ViewHelpers
+
+  def self.template
+<<-TEMPLATE
+<% hashed_javascript_tag(raise_error_on_unrecognized_hash = true) do %>
+  console.log(1)
+<% end %>
+
+<% hashed_style_tag do %>
+  body {
+    background-color: black;
+  }
+<% end %>
+
+<% nonced_javascript_tag do %>
+  body {
+    console.log(1)
+  }
+<% end %>
+
+<% nonced_style_tag do %>
+  body {
+    background-color: black;
+  }
+<% end %>
+<%= @name %>
+
+TEMPLATE
+  end
+
+  def initialize(request, options = {})
+    @virtual_path = "/asdfs/index"
+    @_request = request
+    @template = self.class.template
+    super(@template)
+  end
+
+  def capture(*args)
+    yield(*args)
+  end
+
+  def content_tag(type, content = nil, options = nil, &block)
+    content = if block_given?
+      capture(block)
+    end
+
+    if options.is_a?(Hash)
+      options = options.map {|k,v| " #{k}=#{v}"}
+    end
+    "<#{type}#{options}>#{content}</#{type}>"
+  end
+
+  def result
+    super(binding)
+  end
+
+  def request
+    @_request
+  end
+end
+
+module SecureHeaders
+  describe ViewHelpers do
+    let(:app) { lambda { |env| [200, env, "app"] } }
+    let(:middleware) { Middleware.new(app) }
+    let(:request) { Rack::Request.new("HTTP_USER_AGENT" => USER_AGENTS[:chrome]) }
+    let(:filename) { "app/views/asdfs/index.html.erb" }
+
+    before(:all) do
+      Configuration.default do |config|
+        config.csp[:script_src] = %w('self')
+        config.csp[:style_src] = %w('self')
+      end
+    end
+
+    after(:each) do
+      Configuration.instance_variable_set(:@script_hashes, nil)
+      Configuration.instance_variable_set(:@style_hashes, nil)
+    end
+
+    it "raises an error when using hashed content without precomputed hashes" do
+      expect {
+        Message.new(request).result
+      }.to raise_error(ViewHelpers::UnexpectedHashedScriptException)
+    end
+
+    it "raises an error when using hashed content with precomputed hashes, but none for the given file" do
+      Configuration.instance_variable_set(:@script_hashes, filename.reverse => ["'sha256-123'"])
+      expect {
+        Message.new(request).result
+      }.to raise_error(ViewHelpers::UnexpectedHashedScriptException)
+    end
+
+    it "raises an error when using previously unknown hashed content with precomputed hashes for a given file" do
+      Configuration.instance_variable_set(:@script_hashes, filename => ["'sha256-123'"])
+      expect {
+        Message.new(request).result
+      }.to raise_error(ViewHelpers::UnexpectedHashedScriptException)
+    end
+
+    it "adds known hash values to the corresponding headers when the helper is used" do
+      begin
+        allow(SecureRandom).to receive(:base64).and_return("abc123")
+
+        expected_hash = "sha256-3/URElR9+3lvLIouavYD/vhoICSNKilh15CzI/nKqg8="
+        Configuration.instance_variable_set(:@script_hashes, filename => ["'#{expected_hash}'"])
+        expected_style_hash = "sha256-7oYK96jHg36D6BM042er4OfBnyUDTG3pH1L8Zso3aGc="
+        Configuration.instance_variable_set(:@style_hashes, filename => ["'#{expected_style_hash}'"])
+
+        # render erb that calls out to helpers.
+        Message.new(request).result
+        _, env = middleware.call request.env
+
+        expect(env[CSP::HEADER_NAME]).to match(/script-src[^;]*'#{Regexp.escape(expected_hash)}'/)
+        expect(env[CSP::HEADER_NAME]).to match(/script-src[^;]*'nonce-abc123'/)
+        expect(env[CSP::HEADER_NAME]).to match(/style-src[^;]*'nonce-abc123'/)
+        expect(env[CSP::HEADER_NAME]).to match(/style-src[^;]*'#{Regexp.escape(expected_style_hash)}'/)
+      end
+    end
+  end
+end

data/spec/lib/secure_headers_spec.rb

@@ -2,57 +2,66 @@ require 'spec_helper'
 
 module SecureHeaders
   describe SecureHeaders do
-    example_hpkp_config = {
-      max_age: 1_000_000,
-      include_subdomains: true,
-      report_uri: '//example.com/uri-directive',
-      pins: [
-        { sha256: 'abc' },
-        { sha256: '123' }
-      ]
-    }
-
-    example_hpkp_config_value = %(max-age=1000000; pin-sha256="abc"; pin-sha256="123"; report-uri="//example.com/uri-directive"; includeSubDomains)
-
     before(:each) do
       reset_config
-      @request = Rack::Request.new("HTTP_X_FORWARDED_SSL" => "on")
     end
 
+    let(:request) { Rack::Request.new("HTTP_X_FORWARDED_SSL" => "on") }
+
     it "raises a NotYetConfiguredError if default has not been set" do
       expect do
-        SecureHeaders.header_hash_for(@request)
+        SecureHeaders.header_hash_for(request)
       end.to raise_error(Configuration::NotYetConfiguredError)
     end
 
     it "raises a NotYetConfiguredError if trying to opt-out of unconfigured headers" do
       expect do
-        SecureHeaders.opt_out_of_header(@request, CSP::CONFIG_KEY)
+        SecureHeaders.opt_out_of_header(request, CSP::CONFIG_KEY)
       end.to raise_error(Configuration::NotYetConfiguredError)
     end
 
     describe "#header_hash_for" do
-      it "allows you to opt out of individual headers" do
+      it "allows you to opt out of individual headers via API" do
         Configuration.default
-        SecureHeaders.opt_out_of_header(@request, CSP::CONFIG_KEY)
-        hash = SecureHeaders.header_hash_for(@request)
+        SecureHeaders.opt_out_of_header(request, CSP::CONFIG_KEY)
+        SecureHeaders.opt_out_of_header(request, XContentTypeOptions::CONFIG_KEY)
+        hash = SecureHeaders.header_hash_for(request)
         expect(hash['Content-Security-Policy-Report-Only']).to be_nil
         expect(hash['Content-Security-Policy']).to be_nil
+        expect(hash['X-Content-Type-Options']).to be_nil
+      end
+
+      it "Carries options over when using overrides" do
+        Configuration.default do |config|
+          config.x_download_options = OPT_OUT
+          config.x_permitted_cross_domain_policies = OPT_OUT
+        end
+
+        Configuration.override(:api) do |config|
+          config.x_frame_options = OPT_OUT
+        end
+
+        SecureHeaders.use_secure_headers_override(request, :api)
+        hash = SecureHeaders.header_hash_for(request)
+        expect(hash['X-Download-Options']).to be_nil
+        expect(hash['X-Permitted-Cross-Domain-Policies']).to be_nil
+        expect(hash['X-Frame-Options']).to be_nil
       end
 
       it "allows you to opt out entirely" do
         Configuration.default
-        SecureHeaders.opt_out_of_all_protection(@request)
-        hash = SecureHeaders.header_hash_for(@request)
+        SecureHeaders.opt_out_of_all_protection(request)
+        hash = SecureHeaders.header_hash_for(request)
         ALL_HEADER_CLASSES.each do |klass|
           expect(hash[klass::CONFIG_KEY]).to be_nil
         end
+        expect(hash.count).to eq(0)
       end
 
       it "allows you to override X-Frame-Options settings" do
         Configuration.default
-        SecureHeaders.override_x_frame_options(@request, XFrameOptions::DENY)
-        hash = SecureHeaders.header_hash_for(@request)
+        SecureHeaders.override_x_frame_options(request, XFrameOptions::DENY)
+        hash = SecureHeaders.header_hash_for(request)
         expect(hash[XFrameOptions::HEADER_NAME]).to eq(XFrameOptions::DENY)
       end
 
@@ -62,17 +71,36 @@ module SecureHeaders
           config.csp = OPT_OUT
         end
 
-        SecureHeaders.override_x_frame_options(@request, XFrameOptions::SAMEORIGIN)
-        SecureHeaders.override_content_security_policy_directives(@request, default_src: %w(https:), script_src: %w('self'))
+        SecureHeaders.override_x_frame_options(request, XFrameOptions::SAMEORIGIN)
+        SecureHeaders.override_content_security_policy_directives(request, default_src: %w(https:), script_src: %w('self'))
 
-        hash = SecureHeaders.header_hash_for(@request)
+        hash = SecureHeaders.header_hash_for(request)
         expect(hash[CSP::HEADER_NAME]).to eq("default-src https:; script-src 'self'")
         expect(hash[XFrameOptions::HEADER_NAME]).to eq(XFrameOptions::SAMEORIGIN)
       end
 
+      it "produces a UA-specific CSP when overriding (and busting the cache)" do
+        config = Configuration.default do |config|
+          config.csp = {
+            default_src: %w('self'),
+            child_src: %w('self'), #unsupported by firefox
+            frame_src: %w('self')
+          }
+        end
+        firefox_request = Rack::Request.new(request.env.merge("HTTP_USER_AGENT" => USER_AGENTS[:firefox]))
+
+        # append an unsupported directive
+        SecureHeaders.override_content_security_policy_directives(firefox_request, plugin_types: %w(flash))
+        # append a supported directive
+        SecureHeaders.override_content_security_policy_directives(firefox_request, script_src: %w('self'))
+
+        hash = SecureHeaders.header_hash_for(firefox_request)
+        expect(hash[CSP::HEADER_NAME]).to eq("default-src 'self'; frame-src 'self'; script-src 'self'")
+      end
+
       it "produces a hash of headers with default config" do
         Configuration.default
-        hash = SecureHeaders.header_hash_for(@request)
+        hash = SecureHeaders.header_hash_for(request)
         expect_default_values(hash)
       end
 
@@ -87,7 +115,15 @@ module SecureHeaders
       it "does not set the HPKP header if request is over HTTP" do
         plaintext_request = Rack::Request.new({})
         Configuration.default do |config|
-          config.hpkp = example_hpkp_config
+          config.hpkp = {
+            max_age: 1_000_000,
+            include_subdomains: true,
+            report_uri: '//example.com/uri-directive',
+            pins: [
+              { sha256: 'abc' },
+              { sha256: '123' }
+            ]
+          }
         end
 
         expect(SecureHeaders.header_hash_for(plaintext_request)[PublicKeyPins::HEADER_NAME]).to be_nil
@@ -102,26 +138,67 @@ module SecureHeaders
             }
           end
 
-          SecureHeaders.append_content_security_policy_directives(@request, script_src: %w(anothercdn.com))
-          hash = SecureHeaders.header_hash_for(@request)
+          SecureHeaders.append_content_security_policy_directives(request, script_src: %w(anothercdn.com))
+          hash = SecureHeaders.header_hash_for(request)
           expect(hash[CSP::HEADER_NAME]).to eq("default-src 'self'; script-src mycdn.com 'unsafe-inline' anothercdn.com")
         end
 
+        it "dups global configuration just once when overriding n times and only calls idempotent_additions? once" do
+          Configuration.default do |config|
+            config.csp = {
+              default_src: %w('self')
+            }
+          end
+
+          expect(CSP).to receive(:idempotent_additions?).once
+
+          # before an override occurs, the env is empty
+          expect(request.env[SECURE_HEADERS_CONFIG]).to be_nil
+
+          SecureHeaders.append_content_security_policy_directives(request, script_src: %w(anothercdn.com))
+          new_config = SecureHeaders.config_for(request)
+          expect(new_config).to_not be(Configuration.get)
+
+          SecureHeaders.override_content_security_policy_directives(request, script_src: %w(yet.anothercdn.com))
+          current_config = SecureHeaders.config_for(request)
+          expect(current_config).to be(new_config)
+
+          SecureHeaders.header_hash_for(request)
+        end
+
+        it "doesn't allow you to muck with csp configs when a dynamic policy is in use" do
+          default_config = Configuration.default
+          expect { default_config.csp = {} }.to raise_error(NoMethodError)
+
+          # config is frozen
+          expect { default_config.send(:csp=, {}) }.to raise_error(RuntimeError)
+
+          SecureHeaders.append_content_security_policy_directives(request, script_src: %w(anothercdn.com))
+          new_config = SecureHeaders.config_for(request)
+          expect { new_config.send(:csp=, {}) }.to raise_error(Configuration::IllegalPolicyModificationError)
+
+          expect do
+            new_config.instance_eval do
+              new_config.csp = {}
+            end
+          end.to raise_error(Configuration::IllegalPolicyModificationError)
+        end
+
         it "overrides individual directives" do
           Configuration.default do |config|
             config.csp = {
               default_src: %w('self')
             }
           end
-          SecureHeaders.override_content_security_policy_directives(@request, default_src: %w('none'))
-          hash = SecureHeaders.header_hash_for(@request)
+          SecureHeaders.override_content_security_policy_directives(request, default_src: %w('none'))
+          hash = SecureHeaders.header_hash_for(request)
           expect(hash[CSP::HEADER_NAME]).to eq("default-src 'none'")
         end
 
         it "overrides non-existant directives" do
           Configuration.default
-          SecureHeaders.override_content_security_policy_directives(@request, img_src: [ContentSecurityPolicy::DATA_PROTOCOL])
-          hash = SecureHeaders.header_hash_for(@request)
+          SecureHeaders.override_content_security_policy_directives(request, img_src: [ContentSecurityPolicy::DATA_PROTOCOL])
+          hash = SecureHeaders.header_hash_for(request)
           expect(hash[CSP::HEADER_NAME]).to eq("default-src https:; img-src data:")
         end
 
@@ -134,9 +211,9 @@ module SecureHeaders
             }
           end
 
-          request = Rack::Request.new(@request.env.merge("HTTP_USER_AGENT" => USER_AGENTS[:safari5]))
-          nonce = SecureHeaders.content_security_policy_script_nonce(request)
-          hash = SecureHeaders.header_hash_for(request)
+          safari_request = Rack::Request.new(request.env.merge("HTTP_USER_AGENT" => USER_AGENTS[:safari5]))
+          nonce = SecureHeaders.content_security_policy_script_nonce(safari_request)
+          hash = SecureHeaders.header_hash_for(safari_request)
           expect(hash[CSP::HEADER_NAME]).to eq("default-src 'self'; script-src mycdn.com 'unsafe-inline'; style-src 'self'")
         end
 
@@ -149,15 +226,15 @@ module SecureHeaders
             }
           end
 
-          request = Rack::Request.new(@request.env.merge("HTTP_USER_AGENT" => USER_AGENTS[:chrome]))
-          nonce = SecureHeaders.content_security_policy_script_nonce(request)
+          chrome_request = Rack::Request.new(request.env.merge("HTTP_USER_AGENT" => USER_AGENTS[:chrome]))
+          nonce = SecureHeaders.content_security_policy_script_nonce(chrome_request)
 
           # simulate the nonce being used multiple times in a request:
-          SecureHeaders.content_security_policy_script_nonce(request)
-          SecureHeaders.content_security_policy_script_nonce(request)
-          SecureHeaders.content_security_policy_script_nonce(request)
+          SecureHeaders.content_security_policy_script_nonce(chrome_request)
+          SecureHeaders.content_security_policy_script_nonce(chrome_request)
+          SecureHeaders.content_security_policy_script_nonce(chrome_request)
 
-          hash = SecureHeaders.header_hash_for(request)
+          hash = SecureHeaders.header_hash_for(chrome_request)
           expect(hash['Content-Security-Policy']).to eq("default-src 'self'; script-src mycdn.com 'nonce-#{nonce}'; style-src 'self'")
         end
       end