From 486be06ccbec8b66e6d674f57fc957eb7ba7e011 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Harun=20Sabljakovi=C4=87?= Date: Thu, 6 Jan 2022 10:03:08 +0100 Subject: [PATCH] Remove X-Download-Options default header Since X-Download-Options header is only used by the soon deprecated Internet Explorer, it makes sense to remove this header as a default one. --- actionpack/test/dispatch/response_test.rb | 4 +--- guides/source/security.md | 1 - railties/CHANGELOG.md | 6 ++++++ railties/lib/rails/application/configuration.rb | 10 ++++++++++ .../initializers/new_framework_defaults_7_1.rb.tt | 10 ++++++++++ 5 files changed, 27 insertions(+), 4 deletions(-) diff --git a/actionpack/test/dispatch/response_test.rb b/actionpack/test/dispatch/response_test.rb index 73eb642545..4ba9dd78a1 100644 --- a/actionpack/test/dispatch/response_test.rb +++ b/actionpack/test/dispatch/response_test.rb @@ -333,14 +333,13 @@ class ResponseTest < ActiveSupport::TestCase end end - test "read x_frame_options, x_content_type_options, x_xss_protection, x_download_options and x_permitted_cross_domain_policies, referrer_policy" do + test "read x_frame_options, x_content_type_options, x_xss_protection, x_permitted_cross_domain_policies and referrer_policy" do original_default_headers = ActionDispatch::Response.default_headers begin ActionDispatch::Response.default_headers = { "X-Frame-Options" => "DENY", "X-Content-Type-Options" => "nosniff", "X-XSS-Protection" => "0", - "X-Download-Options" => "noopen", "X-Permitted-Cross-Domain-Policies" => "none", "Referrer-Policy" => "strict-origin-when-cross-origin" } @@ -352,7 +351,6 @@ class ResponseTest < ActiveSupport::TestCase assert_equal("DENY", resp.headers["X-Frame-Options"]) assert_equal("nosniff", resp.headers["X-Content-Type-Options"]) assert_equal("0", resp.headers["X-XSS-Protection"]) - assert_equal("noopen", resp.headers["X-Download-Options"]) assert_equal("none", resp.headers["X-Permitted-Cross-Domain-Policies"]) assert_equal("strict-origin-when-cross-origin", resp.headers["Referrer-Policy"]) ensure diff --git a/guides/source/security.md b/guides/source/security.md index 68115e52eb..d1661ca10c 100644 --- a/guides/source/security.md +++ b/guides/source/security.md @@ -1038,7 +1038,6 @@ config.action_dispatch.default_headers = { 'X-Frame-Options' => 'SAMEORIGIN', 'X-XSS-Protection' => '0', 'X-Content-Type-Options' => 'nosniff', - 'X-Download-Options' => 'noopen', 'X-Permitted-Cross-Domain-Policies' => 'none', 'Referrer-Policy' => 'strict-origin-when-cross-origin' } diff --git a/railties/CHANGELOG.md b/railties/CHANGELOG.md index 7dba88dfdb..7f547242a3 100644 --- a/railties/CHANGELOG.md +++ b/railties/CHANGELOG.md @@ -1,3 +1,9 @@ +* Remove default `X-Download-Options` header + This header is currently only used by Internet Explorer which + will be discontinued in 2022 and since Rails 7 does not fully + support Internet Explorer this header should not be a default one. + + *Harun Sabljaković* Please check [7-0-stable](https://github.com/rails/rails/blob/7-0-stable/railties/CHANGELOG.md) for previous changes. diff --git a/railties/lib/rails/application/configuration.rb b/railties/lib/rails/application/configuration.rb index 5cf0f59c00..bfefb3759c 100644 --- a/railties/lib/rails/application/configuration.rb +++ b/railties/lib/rails/application/configuration.rb @@ -257,6 +257,16 @@ module Rails end when "7.1" load_defaults "7.0" + + if respond_to?(:action_dispatch) + action_dispatch.default_headers = { + "X-Frame-Options" => "SAMEORIGIN", + "X-XSS-Protection" => "0", + "X-Content-Type-Options" => "nosniff", + "X-Permitted-Cross-Domain-Policies" => "none", + "Referrer-Policy" => "strict-origin-when-cross-origin" + } + end else raise "Unknown version #{target_version.to_s.inspect}" end diff --git a/railties/lib/rails/generators/rails/app/templates/config/initializers/new_framework_defaults_7_1.rb.tt b/railties/lib/rails/generators/rails/app/templates/config/initializers/new_framework_defaults_7_1.rb.tt index eaabf6c043..7bc3350cae 100644 --- a/railties/lib/rails/generators/rails/app/templates/config/initializers/new_framework_defaults_7_1.rb.tt +++ b/railties/lib/rails/generators/rails/app/templates/config/initializers/new_framework_defaults_7_1.rb.tt @@ -8,3 +8,13 @@ # # Read the Guide for Upgrading Ruby on Rails for more info on each option. # https://guides.rubyonrails.org/upgrading_ruby_on_rails.html + +# Remove the default X-Download-Options headers since it is used only by Internet Explorer. +# If you need to support Internet Explorer, add back `"X-Download-Options" => "noopen"`. +# Rails.application.config.action_dispatch.default_headers = { +# "X-Frame-Options" => "SAMEORIGIN", +# "X-XSS-Protection" => "0", +# "X-Content-Type-Options" => "nosniff", +# "X-Permitted-Cross-Domain-Policies" => "none", +# "Referrer-Policy" => "strict-origin-when-cross-origin" +# }