module SecureHeaders::InstanceMethods
Public Instance Methods
set_csp_header(req = nil, options=nil)
click to toggle source
backwards compatibility jank, to be removed in 1.0. Old API required a
request object when it didn't really need to. #set_csp_header -
uses the request accessor and SecureHeader::Configuration settings #set_csp_header(Rack::Request
)
- uses the parameter and and SecureHeader::Configuration settings #set_csp_header(Hash
)
- uses the request accessor and options from parameters #set_csp_header(Rack::Request
,
Hash
)
# File lib/secure_headers.rb, line 68 def set_csp_header(req = nil, options=nil) # hack to help generating headers statically if req.is_a?(Hash) options = req end options = self.class.secure_headers_options[:csp] if options.nil? options = self.class.options_for :csp, options return if options == false csp_header = ContentSecurityPolicy.new(options, :request => request, :controller => self) set_header(csp_header) if options && options[:experimental] && options[:enforce] experimental_header = ContentSecurityPolicy.new(options, :experimental => true, :request => request, :controller => self) set_header(experimental_header) end end
set_hsts_header(options=self.class.secure_headers_options[:hsts])
click to toggle source
# File lib/secure_headers.rb, line 99 def set_hsts_header(options=self.class.secure_headers_options[:hsts]) return unless request.ssl? set_a_header(:hsts, StrictTransportSecurity, options) end
set_security_headers(options = self.class.secure_headers_options)
click to toggle source
Re-added for backwards compat.
# File lib/secure_headers.rb, line 53 def set_security_headers(options = self.class.secure_headers_options) set_csp_header(request, options[:csp]) set_hsts_header(options[:hsts]) set_x_frame_options_header(options[:x_frame_options]) set_x_xss_protection_header(options[:x_xss_protection]) set_x_content_type_options_header(options[:x_content_type_options]) set_x_download_options_header(options[:x_download_options]) end
set_x_content_type_options_header(options=self.class.secure_headers_options[:x_content_type_options])
click to toggle source
# File lib/secure_headers.rb, line 91 def set_x_content_type_options_header(options=self.class.secure_headers_options[:x_content_type_options]) set_a_header(:x_content_type_options, XContentTypeOptions, options) end
set_x_download_options_header(options=self.class.secure_headers_options[:x_download_options])
click to toggle source
# File lib/secure_headers.rb, line 104 def set_x_download_options_header(options=self.class.secure_headers_options[:x_download_options]) set_a_header(:x_download_options, XDownloadOptions, options) end
set_x_frame_options_header(options=self.class.secure_headers_options[:x_frame_options])
click to toggle source
# File lib/secure_headers.rb, line 87 def set_x_frame_options_header(options=self.class.secure_headers_options[:x_frame_options]) set_a_header(:x_frame_options, XFrameOptions, options) end
set_x_xss_protection_header(options=self.class.secure_headers_options[:x_xss_protection])
click to toggle source
# File lib/secure_headers.rb, line 95 def set_x_xss_protection_header(options=self.class.secure_headers_options[:x_xss_protection]) set_a_header(:x_xss_protection, XXssProtection, options) end
Private Instance Methods
set_a_header(name, klass, options=nil)
click to toggle source
# File lib/secure_headers.rb, line 110 def set_a_header(name, klass, options=nil) options = self.class.options_for name, options return if options == false header = klass.new(options) set_header(header) end
set_header(name_or_header, value=nil)
click to toggle source
# File lib/secure_headers.rb, line 118 def set_header(name_or_header, value=nil) if name_or_header.is_a?(Header) header = name_or_header response.headers[header.name] = header.value else response.headers[name_or_header] = value end end