123456789_123456789_123456789_123456789_123456789_

Class: Rack::Protection::FrameOptions

Relationships & Source Files
Super Chains via Extension / Inclusion / Inheritance
Class Chain:
self, Base
Instance Chain:
self, Base
Inherits: Rack::Protection::Base
Defined in: rack-protection/lib/rack/protection/frame_options.rb

Overview

Prevented attack

Clickjacking

Supported browsers
More info

Sets X-Frame-Options header to tell the browser avoid embedding the page in a frame. Note that in modern browsers, the preferred approach is to use the frame-ancestors directive in your content security policy.

Notes:

  • This middleware won't do anything for non-HTML responses.
  • If your app sets X-Frame-Options header, this middleware will not override it.

Options

[:frame_options] Defines who should be allowed to embed the page in a frame. [:deny] forbid any embedding [:sameorigin] allow embedding from the same origin

The default is <tt>:sameorigin</tt>.

[Rack::Protection::Base options] options supported by Rack::Protection::Base may affect this middleware.

Example: Default behavior

# Embedding from same origin is allowed
use Rack::Protection::FrameOptions

Example: Deny embedding

# Embedding is not allowed
use Rack::Protection::FrameOptions, frame_options: :deny

Constant Summary

Base - Inherited

DEFAULT_OPTIONS

Class Method Summary

Base - Inherited

.default_options

Used by subclasses to declare default values for options they require.
.default_reaction

Used by subclasses to declare default reaction when a request is rejected.
.new

Instance Attribute Summary

Base - Inherited

#app, #options

Instance Method Summary

Base - Inherited

#accepts?, #call, #debug, #default_options,
#default_reaction

Alias for Base#deny.
#deny

Deny the request.
#drop_session, #encrypt, #html?, #instrument, #origin, #random_string, #react, #referrer,
#report

When used as a reaction (with option reaction: :report), any rejected request will be allowed through, and a warning is omitted (note that warnings will not be shown if the :logging option has been set to false).
#safe?, #secure_compare, #session, #session?, #warn

Constructor Details

This class inherits a constructor from Rack::Protection::Base

Instance Method Details

#call(env)

[ GitHub ] 

  


# File 'rack-protection/lib/rack/protection/frame_options.rb', line 60



def call(env)
  status, headers, body        = @app.call(env)
  headers['x-frame-options'] ||= frame_options if html? headers
  [status, headers, body]
end


  








  

    #frame_options  
  

  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/frame_options.rb', line 52



def frame_options
  @frame_options ||= begin
    frame_options = options[:frame_options]
    frame_options = options[:frame_options].to_s.upcase unless frame_options.respond_to? :to_str
    frame_options.to_str
  end
end