class Rack::SecureHeaders

Constants

DEFAULTS
VERSION

Public Class Methods

new(app, options = {}) click to toggle source
# File lib/rack/secure_headers.rb, line 13
def initialize(app, options = {})
  options = DEFAULTS.merge(options)

  @app = app
  @headers = base_headers(options)

  if options[:hsts]
    @headers["Strict-Transport-Security"] = hsts_header(options[:hsts])
  end
end

Public Instance Methods

call(env) click to toggle source
# File lib/rack/secure_headers.rb, line 24
def call(env)
  return @app.call(env).tap do |_, headers, _|
    @headers.each do |key, value|
      headers[key] ||= value
    end
  end
end

Private Instance Methods

base_headers(options) click to toggle source
# File lib/rack/secure_headers.rb, line 34
def base_headers(options)
  headers = {
    "X-Content-Type-Options" => options[:x_content_type_options],
    "X-Frame-Options" => options[:x_frame_options],
    "X-Permitted-Cross-Domain-Policies" => options[:x_permitted_cross_domain_policies],
    "X-XSS-Protection" => options[:x_xss_protection],
  }

  headers.each do |header, value|
    headers.delete(header) if value.nil?
  end

  return headers
end
hsts_header(options) click to toggle source
# File lib/rack/secure_headers.rb, line 49
def hsts_header(options)
  header = sprintf("max-age=%s", options.fetch(:max_age))
  header << "; includeSubdomains" if options[:include_subdomains]
  header << "; preload" if options[:preload]

  return header
end