123456789_123456789_123456789_123456789_123456789_

Class: Rack::Protection::FrameOptions

Relationships & Source Files
Super Chains via Extension / Inclusion / Inheritance
Class Chain:
self, Base
Instance Chain:
self, Base
Inherits: Rack::Protection::Base
Defined in: rack-protection/lib/rack/protection/frame_options.rb

Overview

Prevented attack:: Clickjacking Supported browsers:: Internet Explorer 8, Firefox 3.6.9, Opera 10.50, Safari 4.0, Chrome 4.1.249.1042 and later More infos:: https://developer.mozilla.org/en/The_X-FRAME-OPTIONS_response_header

Sets X-Frame-Options header to tell the browser avoid embedding the page in a frame.

Options:

frame_options:: Defines who should be allowed to embed the page in a frame. Use :deny to forbid any embedding, :sameorigin to allow embedding from the same origin (default).

Constant Summary

Base - Inherited

DEFAULT_OPTIONS

Class Method Summary

Base - Inherited

.default_options, .default_reaction, .new

Instance Attribute Summary

Base - Inherited

#app, #options

Instance Method Summary

Base - Inherited

#accepts?, #call, #debug, #default_options,
#default_reaction

Alias for Base#deny.
#deny, #drop_session, #encrypt, #html?, #instrument, #origin, #random_string, #react, #referrer, #report, #safe?, #secure_compare, #session, #session?, #warn

Constructor Details

This class inherits a constructor from Rack::Protection::Base

Instance Method Details

#call(env)

[ GitHub ] 

  


# File 'rack-protection/lib/rack/protection/frame_options.rb', line 32



def call(env)
  status, headers, body        = @app.call(env)
  headers['x-frame-options'] ||= frame_options if html? headers
  [status, headers, body]
end


  








  

    #frame_options  
  

  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/frame_options.rb', line 24



def frame_options
  @frame_options ||= begin
    frame_options = options[:frame_options]
    frame_options = options[:frame_options].to_s.upcase unless frame_options.respond_to? :to_str
    frame_options.to_str
  end
end