Class: Rack::Protection::XSSHeader
- Defined in:
- lib/rubypitaya/app-template/vendor/bundle/ruby/3.1.0/gems/rack-protection-3.0.5/lib/rack/protection/xss_header.rb
Overview
- Prevented attack
-
Non-permanent XSS
- Supported browsers
-
Internet Explorer 8+ and Chrome
- More infos
-
blogs.msdn.com/b/ie/archive/2008/07/01/ie8-security-part-iv-the-xss-filter.aspx
Sets X-XSS-Protection header to tell the browser to block attacks.
Options:
- xss_mode
-
How the browser should prevent the attack (default: :block)
Constant Summary
Constants inherited from Base
Instance Attribute Summary
Attributes inherited from Base
Instance Method Summary collapse
Methods inherited from Base
#accepts?, #default_options, default_options, default_reaction, #deny, #drop_session, #encrypt, #html?, #initialize, #instrument, #origin, #random_string, #react, #referrer, #report, #safe?, #secure_compare, #session, #session?, #warn
Constructor Details
This class inherits a constructor from Rack::Protection::Base
Instance Method Details
#call(env) ⇒ Object
19 20 21 22 23 24 |
# File 'lib/rubypitaya/app-template/vendor/bundle/ruby/3.1.0/gems/rack-protection-3.0.5/lib/rack/protection/xss_header.rb', line 19 def call(env) status, headers, body = @app.call(env) headers['X-XSS-Protection'] ||= "1; mode=#{[:xss_mode]}" if html? headers headers['X-Content-Type-Options'] ||= 'nosniff' if [:nosniff] [status, headers, body] end |