class Rack::Protection::XSSHeader

Prevented attack

Non-permanent XSS

Supported browsers

Internet Explorer 8 and later

More infos

blogs.msdn.com/b/ie/archive/2008/07/01/ie8-security-part-iv-the-xss-filter.aspx

Sets X-XSS-Protection header to tell the browser to block attacks.

Options:

xss_mode

How the browser should prevent the attack (default: :block)

Public Instance Methods

call(env) click to toggle source
# File lib/rack/protection/xss_header.rb, line 26
def call(env)
  status, headers, body = @app.call(env)
  headers = header.merge(headers) if options[:nosniff] and html?(headers)
  [status, headers, body]
end
header() click to toggle source
# File lib/rack/protection/xss_header.rb, line 17
def header
  headers = {
    'X-XSS-Protection' => "1; mode=#{options[:xss_mode]}",
    'X-Content-Type-Options' => "nosniff"
  }
  headers.delete("X-Content-Type-Options") unless options[:nosniff]
  headers
end