Add latest changes from gitlab-org/gitlab@15-3-stable-eev15.3.0-rc42

1 files changed, 7 insertions, 0 deletions

diff --git a/lib/api/api.rb b/lib/api/api.rb
index 8827371546c..e4158eee37f 100644
--- a/lib/api/api.rb
+++ b/lib/api/api.rb
@@ -22,6 +22,7 @@ module API
                     Gitlab::GrapeLogging::Loggers::ClientEnvLogger.new,
                     Gitlab::GrapeLogging::Loggers::RouteLogger.new,
                     Gitlab::GrapeLogging::Loggers::UserLogger.new,
+                    Gitlab::GrapeLogging::Loggers::TokenLogger.new,
                     Gitlab::GrapeLogging::Loggers::ExceptionLogger.new,
                     Gitlab::GrapeLogging::Loggers::QueueDurationLogger.new,
                     Gitlab::GrapeLogging::Loggers::PerfLogger.new,
@@ -47,6 +48,12 @@ module API
     before do
       header['X-Frame-Options'] = 'SAMEORIGIN'
       header['X-Content-Type-Options'] = 'nosniff'
+
+      if Rails.application.config.content_security_policy && !Rails.application.config.content_security_policy_report_only
+        policy = ActionDispatch::ContentSecurityPolicy.new { |p| p.default_src :none }
+      end
+
+      request.env[ActionDispatch::ContentSecurityPolicy::Request::POLICY] = policy
     end
 
     before do