Non-permanent XSS
Internet Explorer 8 and later
blogs.msdn.com/b/ie/archive/2008/07/01/ie8-security-part-iv-the-xss-filter.aspx
Sets X-XSS-Protection header to tell the browser to block attacks.
Options:
How the browser should prevent the attack (default: :block)
# File lib/rack/protection/xss_header.rb, line 26 def call(env) status, headers, body = @app.call(env) headers = header.merge(headers) if options[:nosniff] and html?(headers) [status, headers, body] end
# File lib/rack/protection/xss_header.rb, line 17 def header headers = { 'X-XSS-Protection' => "1; mode=#{options[:xss_mode]}", 'X-Content-Type-Options' => "nosniff" } headers.delete("X-Content-Type-Options") unless options[:nosniff] headers end