Class: Rack::Protection::XSSHeader

Inherits:
Base
  • Object
show all
Defined in:
lib/rack/protection/xss_header.rb

Overview

Prevented attack

Non-permanent XSS

Supported browsers

Internet Explorer 8+ and Chrome

More infos

blogs.msdn.com/b/ie/archive/2008/07/01/ie8-security-part-iv-the-xss-filter.aspx

Sets X-XSS-Protection header to tell the browser to block attacks.

Options:

xss_mode

How the browser should prevent the attack (default: :block)

Constant Summary

Constants inherited from Base

Base::DEFAULT_OPTIONS

Instance Attribute Summary

Attributes inherited from Base

#app, #options

Instance Method Summary collapse

Methods inherited from Base

#accepts?, #default_options, default_options, default_reaction, #deny, #drop_session, #encrypt, #html?, #initialize, #instrument, #origin, #random_string, #react, #referrer, #report, #safe?, #secure_compare, #session, #session?, #warn

Constructor Details

This class inherits a constructor from Rack::Protection::Base

Instance Method Details

#call(env) ⇒ Object 



19
20
21
22
23
24
 
# File 'lib/rack/protection/xss_header.rb', line 19

def call(env)
  status, headers, body = @app.call(env)
  headers['X-XSS-Protection']       ||= "1; mode=#{options[:xss_mode]}" if html? headers
  headers['X-Content-Type-Options'] ||= 'nosniff'                       if options[:nosniff]
  [status, headers, body]
end