Class: Rack::Protection::XSSHeader

Inherits:
Base
  • Object
show all
Defined in:
lib/rack/protection/xss_header.rb

Overview

Prevented attack

Non-permanent XSS

Supported browsers

Internet Explorer 8 and later

More infos

blogs.msdn.com/b/ie/archive/2008/07/01/ie8-security-part-iv-the-xss-filter.aspx

Sets X-XSS-Protection header to tell the browser to block attacks.

Options:

xss_mode

How the browser should prevent the attack (default: :block)

Direct Known Subclasses

FrameOptions

Constant Summary

Constants inherited from Base

Base::DEFAULT_OPTIONS

Instance Attribute Summary

Attributes inherited from Base

#app, #options

Instance Method Summary collapse

Methods inherited from Base

#accepts?, #default_options, default_options, default_reaction, #deny, #drop_session, #encrypt, #initialize, #random_string, #react, #referrer, #safe?, #session, #session?, #warn

Constructor Details

This class inherits a constructor from Rack::Protection::Base

Instance Method Details

#call(env) ⇒ Object 



21
22
23
24
 
# File 'lib/rack/protection/xss_header.rb', line 21

def call(env)
  status, headers, body = @app.call(env)
  [status, header.merge(headers), body]
end

#header ⇒ Object 



17
18
19
 
# File 'lib/rack/protection/xss_header.rb', line 17

def header
  { 'X-XSS-Protection' => "1; mode=#{options[:xss_mode]}" }
end