Class: Rack::Protection::FrameOptions

Inherits:
Base
  • Object
show all
Defined in:
lib/rack/protection/frame_options.rb

Overview

Prevented attack

Clickjacking

Supported browsers

Internet Explorer 8, Firefox 3.6.9, Opera 10.50, Safari 4.0, Chrome 4.1.249.1042 and later

More infos

developer.mozilla.org/en/The_X-FRAME-OPTIONS_response_header

Sets X-Frame-Options header to tell the browser avoid embedding the page in a frame.

Options:

frame_options

Defines who should be allowed to embed the page in a frame. Use :deny to forbid any embedding, :sameorigin to allow embedding from the same origin (default).

Constant Summary

Constants inherited from Base

Base::DEFAULT_OPTIONS

Instance Attribute Summary

Attributes inherited from Base

#app, #options

Instance Method Summary collapse

Methods inherited from Base

#accepts?, #debug, #default_options, default_options, default_reaction, #deny, #drop_session, #encrypt, #html?, #initialize, #instrument, #origin, #random_string, #react, #referrer, #report, #safe?, #secure_compare, #session, #session?, #warn

Constructor Details

This class inherits a constructor from Rack::Protection::Base

Instance Method Details

#call(env) ⇒ Object 



32
33
34
35
36
 
# File 'lib/rack/protection/frame_options.rb', line 32

def call(env)
  status, headers, body        = @app.call(env)
  headers['x-frame-options'] ||= frame_options if html? headers
  [status, headers, body]
end

#frame_options ⇒ Object 



24
25
26
27
28
29
30
 
# File 'lib/rack/protection/frame_options.rb', line 24

def frame_options
  @frame_options ||= begin
    frame_options = options[:frame_options]
    frame_options = options[:frame_options].to_s.upcase unless frame_options.respond_to? :to_str
    frame_options.to_str
  end
end