Sha256: 08659a209da58e0cd05c7b1509b78bdb48dfce7d828902c8a6a7074645f127c8
Contents?: true
Size: 1.22 KB
Versions: 121
Compression:
Stored size: 1.22 KB
Contents
require 'rack/protection'
module Rack
module Protection
##
# Prevented attack:: Clickjacking
# Supported browsers:: Internet Explorer 8, Firefox 3.6.9, Opera 10.50,
# Safari 4.0, Chrome 4.1.249.1042 and later
# More infos:: https://developer.mozilla.org/en/The_X-FRAME-OPTIONS_response_header
#
# Sets X-Frame-Options header to tell the browser avoid embedding the page
# in a frame.
#
# Options:
#
# frame_options:: Defines who should be allowed to embed the page in a
# frame. Use :deny to forbid any embedding, :sameorigin
# to allow embedding from the same origin (default).
class FrameOptions < Base
default_options :frame_options => :sameorigin
def frame_options
@frame_options ||= begin
frame_options = options[:frame_options]
frame_options = options[:frame_options].to_s.upcase unless frame_options.respond_to? :to_str
frame_options.to_str
end
end
def call(env)
status, headers, body = @app.call(env)
headers['X-Frame-Options'] ||= frame_options if html? headers
[status, headers, body]
end
end
end
end
Version data entries
121 entries across 112 versions & 24 rubygems