123456789_123456789_123456789_123456789_123456789_

Class: Rack::Protection::StrictTransport

Relationships & Source Files
Super Chains via Extension / Inclusion / Inheritance
Class Chain:
self, Base
Instance Chain:
self, Base
Inherits: Rack::Protection::Base
Defined in: rack-protection/lib/rack/protection/strict_transport.rb

Overview

Prevented attack

Protects against against protocol downgrade attacks and cookie hijacking.

Supported browsers

All modern browsers. See https://caniuse.com/stricttransportsecurity

More info

https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

Sets the Strict-Transport-Security http header. This headers tells the browser that HTTP requests will be upgraded to HTTPS. It also prevents HTTPS click through prompts on browsers.

Note that if an upstream middleware sets the Strict-Transport-Security header, this middleware will not overwrite it and thus have no effect.

Options

[:max_age] Time, in seconds, that the browser should remember the requirement to use HTTPS. Default is one year. [:include_subdomains] If true, all present and future subdomains should also use HTTPS. Default is false. [:preload] Allow this domain to be included in browsers HSTS preload list. Default is false. See https://hstspreload.org/

Constant Summary

Base - Inherited

DEFAULT_OPTIONS

Class Method Summary

Base - Inherited

.default_options

Used by subclasses to declare default values for options they require.
.default_reaction

Used by subclasses to declare default reaction when a request is rejected.
.new

Instance Attribute Summary

Base - Inherited

#app, #options

Instance Method Summary

Base - Inherited

#accepts?, #call, #debug, #default_options,
#default_reaction

Alias for Base#deny.
#deny

Deny the request.
#drop_session, #encrypt, #html?, #instrument, #origin, #random_string, #react, #referrer,
#report

When used as a reaction (with option reaction: :report), any rejected request will be allowed through, and a warning is omitted (note that warnings will not be shown if the :logging option has been set to false).
#safe?, #secure_compare, #session, #session?, #warn

Constructor Details

This class inherits a constructor from Rack::Protection::Base

Instance Method Details

#call(env)

[ GitHub ] 

  


# File 'rack-protection/lib/rack/protection/strict_transport.rb', line 38



def call(env)
  status, headers, body = @app.call(env)
  headers['strict-transport-security'] ||= strict_transport
  [status, headers, body]
end


  








  

    #strict_transport  
  

  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/strict_transport.rb', line 29



def strict_transport
  @strict_transport ||= begin
    strict_transport = "max-age=#{options[:max_age]}"
    strict_transport += '; includeSubDomains' if options[:include_subdomains]
    strict_transport += '; preload' if options[:preload]
    strict_transport.to_str
  end
end