Skip to content
This repository
Browse code

introduce default_headers config

  • Loading branch information...
commit 2a290f7f7cdf775491eda05b3690be6d96cd9bf6 1 parent 2da242f
Egor Homakov authored
5  actionpack/lib/action_dispatch/http/response.rb
@@ -58,6 +58,7 @@ class Response
58 58
     LOCATION     = "Location".freeze
59 59
 
60 60
     cattr_accessor(:default_charset) { "utf-8" }
  61
+    cattr_accessor(:default_headers)
61 62
 
62 63
     include Rack::Response::Helpers
63 64
     include ActionDispatch::Http::Cache::Response
@@ -96,6 +97,10 @@ def closed?
96 97
     def initialize(status = 200, header = {}, body = [])
97 98
       super()
98 99
 
  100
+      if self.class.default_headers.respond_to?(:merge)
  101
+        header = self.class.default_headers.merge(header)
  102
+      end
  103
+
99 104
       self.body, self.header, self.status = body, header, status
100 105
 
101 106
       @sending_file = false
1  actionpack/lib/action_dispatch/railtie.rb
@@ -23,6 +23,7 @@ class Railtie < Rails::Railtie
23 23
       ActionDispatch::Http::URL.tld_length = app.config.action_dispatch.tld_length
24 24
       ActionDispatch::Request.ignore_accept_header = app.config.action_dispatch.ignore_accept_header
25 25
       ActionDispatch::Response.default_charset = app.config.action_dispatch.default_charset || app.config.encoding
  26
+      ActionDispatch::Response.default_headers = app.config.action_dispatch.default_headers
26 27
 
27 28
       ActionDispatch::ExceptionWrapper.rescue_responses.merge!(config.action_dispatch.rescue_responses)
28 29
       ActionDispatch::ExceptionWrapper.rescue_templates.merge!(config.action_dispatch.rescue_templates)
5  railties/lib/rails/generators/rails/app/templates/config/application.rb
@@ -41,6 +41,11 @@ class Application < Rails::Application
41 41
     # Configure sensitive parameters which will be filtered from the log file.
42 42
     config.filter_parameters += [:password]
43 43
 
  44
+    config.action_dispatch.default_headers = {
  45
+        'X-Frame-Options' => 'SAMEORIGIN',
  46
+        'X-XSS-Protection' => '1; mode=block'
  47
+    }
  48
+
44 49
     # Use SQL instead of Active Record's schema dumper when creating the database.
45 50
     # This is necessary if your schema can't be completely dumped by the schema dumper,
46 51
     # like if you have constraints or database-specific column types.

0 notes on commit 2a290f7

Please sign in to comment.
Something went wrong with that request. Please try again.