kotovalexarian-likes-github/rails--rails
1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
Code Releases Activity

Added X-Content-Type-Options to the header defaults.

Browse source 
With a value of "nosniff", this prevents Internet Explorer from MIME-sniffing a response away from the declared content-type.
This commit is contained in:
Jim Jones 2012-08-18 15:29:58 -07:00
parent db78e58294
commit 4848bf321b
4 changed files with 9 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
actionpack/CHANGELOG.md
View file

@ -51,8 +51,9 @@
*Richard Schneeman*
* Add 'X-Frame-Options' => 'SAMEORIGIN' and
'X-XSS-Protection' => '1; mode=block'
* Add 'X-Frame-Options' => 'SAMEORIGIN'
'X-XSS-Protection' => '1; mode=block' and
'X-Content-Type-Options' => 'nosniff'
as default headers.
*Egor Homakov*

3
actionpack/lib/action_dispatch/railtie.rb
View file

@ -21,7 +21,8 @@ module ActionDispatch
config.action_dispatch.default_headers = {
'X-Frame-Options' => 'SAMEORIGIN',
'X-XSS-Protection' => '1; mode=block'
'X-XSS-Protection' => '1; mode=block',
'X-Content-Type-Options' => 'nosniff'
}
initializer "action_dispatch.configure" do |app|

4
actionpack/test/dispatch/response_test.rb
View file

@ -177,9 +177,10 @@ class ResponseTest < ActiveSupport::TestCase
end
end
test "read x_frame_options and x_xss_protection" do
test "read x_frame_options, x_content_type_options and x_xss_protection" do
ActionDispatch::Response.default_headers = {
'X-Frame-Options' => 'DENY',
'X-Content-Type-Options' => 'nosniff',
'X-XSS-Protection' => '1;'
}
resp = ActionDispatch::Response.new.tap { |response|
@ -188,6 +189,7 @@ class ResponseTest < ActiveSupport::TestCase
resp.to_a
assert_equal('DENY', resp.headers['X-Frame-Options'])
assert_equal('nosniff', resp.headers['X-Content-Type-Options'])
assert_equal('1;', resp.headers['X-XSS-Protection'])
end

2
guides/source/configuring.textile
View file

@ -341,7 +341,7 @@ h4. Configuring Action Dispatch
* +config.action_dispatch.default_headers+ is a hash with HTTP headers that are set by default in each response. By default, this is defined as:
<ruby>
config.action_dispatch.default_headers = { 'X-Frame-Options' => 'SAMEORIGIN', 'X-XSS-Protection' => '1; mode=block' }
config.action_dispatch.default_headers = { 'X-Frame-Options' => 'SAMEORIGIN', 'X-XSS-Protection' => '1; mode=block', 'X-Content-Type-Options' => 'nosniff' }
</ruby>
* +config.action_dispatch.tld_length+ sets the TLD (top-level domain) length for the application. Defaults to +1+.