class Bezel::Plug::SecureHeaders
include Bezel::Plug
Sets the response headers that keep browsers from misreading or
framing the application's pages: X-Content-Type-Options: nosniff,
X-Frame-Options (SAMEORIGIN by default), Referrer-Policy
(strict-origin-when-cross-origin), and, when given, a
Content-Security-Policy and Strict-Transport-Security (hsts:,
a max-age in seconds; only for an application served over HTTPS).
A header the application sets itself later in the pipeline wins.
Class methods
def self.new(*, frame_options: String? = …, referrer_policy: String? = …, csp: String? = …, hsts: Int? = …) -> Bezel::Plug::SecureHeaders
The plug; nil leaves a header out.
Methods
def call(conn: Bezel::Conn) -> Bezel::Conn
The connection changed by this plug.
from Bezel::Plug