secure_headers basic use

application_controller.rb

class ApplicationController < ActionController::Base
  def add_csp_exceptions
    append_content_security_policy_directives(self.class::CSP_EXCEPTIONS)
  end
end

example_controller.rb

class ExampleController < ApplicationController
  CSP_EXCEPTIONS = {
    frame_src: ["foo.com"],
  }
  before_action :add_csp_exceptions, only: :show
  
  def index
    # doesn't get the additonal allowance
  end
  
  def show
    # gets foo.com appended to the current frame_src value
  end
end

other_controller.rb

class OtherController < ApplicationController
  def index
    if feature_enabled?
      append_content_security_policy_directives(connect_src: [THIRD_PARTY])
    end
  end
end