Sha256: f26b6ce3714baeefc84d5251f84bab0eded9b6d5b633517489b76ec95fd257d8
Contents?: true
Size: 895 Bytes
Versions: 13
Compression:
Stored size: 895 Bytes
Contents
# frozen_string_literal: true
require 'rack/protection'
module Rack
module Protection
##
# Prevented attack:: Non-permanent XSS
# Supported browsers:: Internet Explorer 8+ and Chrome
# More infos:: http://blogs.msdn.com/b/ie/archive/2008/07/01/ie8-security-part-iv-the-xss-filter.aspx
#
# Sets X-XSS-Protection header to tell the browser to block attacks.
#
# Options:
# xss_mode:: How the browser should prevent the attack (default: :block)
class XSSHeader < Base
default_options xss_mode: :block, nosniff: true
def call(env)
status, headers, body = @app.call(env)
headers['X-XSS-Protection'] ||= "1; mode=#{options[:xss_mode]}" if html? headers
headers['X-Content-Type-Options'] ||= 'nosniff' if options[:nosniff]
[status, headers, body]
end
end
end
end
Version data entries
13 entries across 13 versions & 2 rubygems