class Rack::Protection::XSSHeader
- Prevented attack
-
Non-permanent XSS
- Supported browsers
-
Internet Explorer 8 and later
- More infos
-
blogs.msdn.com/b/ie/archive/2008/07/01/ie8-security-part-iv-the-xss-filter.aspx
Sets X-XSS-Protection header to tell the browser to block attacks.
Options:
- xss_mode
-
How the browser should prevent the attack (default: :block)
Public Instance Methods
call(env)
click to toggle source
# File lib/rack/protection/xss_header.rb, line 17 def call(env) status, headers, body = @app.call(env) headers['X-XSS-Protection'] ||= "1; mode=#{options[:xss_mode]}" if html? headers headers['X-Content-Type-Options'] ||= 'nosniff' if options[:nosniff] [status, headers, body] end