SecureHeaders::InstanceMethods

Public Instance Methods

set_csp_header(req = nil, options=nil) click to toggle source

backwards compatibility jank, to be removed in 1.0. Old API required a request object when it didn't really need to. set_csp_header - uses the request accessor and SecureHeader::Configuration settings set_csp_header(+Rack::Request+) - uses the parameter and and SecureHeader::Configuration settings set_csp_header(Hash) - uses the request accessor and options from parameters set_csp_header(+Rack::Request+, Hash)

# File lib/secure_headers.rb, line 68
def set_csp_header(req = nil, options=nil)
  # hack to help generating headers statically
  if req.is_a?(Hash)
    options = req
  end

  options = self.class.secure_headers_options[:csp] if options.nil?
  options = self.class.options_for :csp, options

  return if options == false

  csp_header = ContentSecurityPolicy.new(options, :request => request, :controller => self)
  set_header(csp_header)
  if options && options[:experimental] && options[:enforce]
    experimental_header = ContentSecurityPolicy.new(options, :experimental => true, :request => request, :controller => self)
    set_header(experimental_header)
  end
end
set_hsts_header(options=self.class.secure_headers_options[:hsts]) click to toggle source
# File lib/secure_headers.rb, line 99
def set_hsts_header(options=self.class.secure_headers_options[:hsts])
  return unless request.ssl?
  set_a_header(:hsts, StrictTransportSecurity, options)
end
set_security_headers(options = self.class.secure_headers_options) click to toggle source

Re-added for backwards compat.

# File lib/secure_headers.rb, line 53
def set_security_headers(options = self.class.secure_headers_options)
  set_csp_header(request, options[:csp])
  set_hsts_header(options[:hsts])
  set_x_frame_options_header(options[:x_frame_options])
  set_x_xss_protection_header(options[:x_xss_protection])
  set_x_content_type_options_header(options[:x_content_type_options])
  set_x_download_options_header(options[:x_download_options])
end
set_x_content_type_options_header(options=self.class.secure_headers_options[:x_content_type_options]) click to toggle source
# File lib/secure_headers.rb, line 91
def set_x_content_type_options_header(options=self.class.secure_headers_options[:x_content_type_options])
  set_a_header(:x_content_type_options, XContentTypeOptions, options)
end
set_x_download_options_header(options=self.class.secure_headers_options[:x_download_options]) click to toggle source
# File lib/secure_headers.rb, line 104
def set_x_download_options_header(options=self.class.secure_headers_options[:x_download_options])
  set_a_header(:x_download_options, XDownloadOptions, options)
end
set_x_frame_options_header(options=self.class.secure_headers_options[:x_frame_options]) click to toggle source
# File lib/secure_headers.rb, line 87
def set_x_frame_options_header(options=self.class.secure_headers_options[:x_frame_options])
  set_a_header(:x_frame_options, XFrameOptions, options)
end
set_x_xss_protection_header(options=self.class.secure_headers_options[:x_xss_protection]) click to toggle source
# File lib/secure_headers.rb, line 95
def set_x_xss_protection_header(options=self.class.secure_headers_options[:x_xss_protection])
  set_a_header(:x_xss_protection, XXssProtection, options)
end

[Validate]

Generated with the Darkfish Rdoc Generator 2.