Class: Rack::Protection::XSSHeader

### Home Classes Methods

### In Files

- lib/rack/protection/xss_header.rb

### Parent

Rack::Protection::Base

### Methods

- #call

### Class/Module Index

Quicksearch

- Rack
- Rack::Protection
- Rack::Protection::AuthenticityToken
- Rack::Protection::Base
- Rack::Protection::EscapedParams
- Rack::Protection::FormToken
- Rack::Protection::FrameOptions
- Rack::Protection::HttpOrigin
- Rack::Protection::IPSpoofing
- Rack::Protection::JsonCsrf
- Rack::Protection::PathTraversal
- Rack::Protection::RemoteReferrer
- Rack::Protection::RemoteToken
- Rack::Protection::SessionHijacking
- Rack::Protection::VERSION
- Rack::Protection::XSSHeader

No matching classes.

# Rack::Protection::XSSHeader

Prevented attack | Non-permanent XSS
Supported browsers | Internet Explorer 8 and later
More infos | blogs.msdn.com/b/ie/archive/2008/07/01/ie8-security-part-iv-the-xss-filter.aspx

Sets X-XSS-Protection header to tell the browser to block attacks.

Options:

xss_mode | How the browser should prevent the attack (default: :block)

### Public Instance Methods

call(env) click to toggle source

    # File lib/rack/protection/xss_header.rb, line 17
    def call(env)
      status, headers, body = @app.call(env)
      headers['X-XSS-Protection']       ||= "1; mode=#{options[:xss_mode]}" if html? headers
      headers['X-Content-Type-Options'] ||= 'nosniff'                       if options[:nosniff]
      [status, headers, body]
    end

[Validate]

Generated with the Darkfish Rdoc Generator 2.