rmorawski/standardnotes-app-web
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

iFrame options

Browse Source
This commit is contained in:
Mo Bitar
2018-10-30 12:45:54 -05:00
parent f3954bf9ee
commit 31d38b93d4
2 changed files with 3 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
Gemfile.lock
View File

@@ -148,8 +148,7 @@ GEM
sdoc (0.4.2) sdoc (0.4.2)
json (~> 1.7, >= 1.7.7) json (~> 1.7, >= 1.7.7)
rdoc (~> 4.0) rdoc (~> 4.0)
secure_headers (5.0.5) secure_headers (6.0.0)
useragent (>= 0.15.0)
sidekiq (5.1.3) sidekiq (5.1.3)
concurrent-ruby (~> 1.0) concurrent-ruby (~> 1.0)
connection_pool (~> 2.2, >= 2.2.0) connection_pool (~> 2.2, >= 2.2.0)
@@ -175,7 +174,6 @@ GEM
thread_safe (~> 0.1) thread_safe (~> 0.1)
uglifier (4.1.10) uglifier (4.1.10)
execjs (>= 0.3.0, < 3) execjs (>= 0.3.0, < 3)
useragent (0.16.10)
web-console (3.5.1) web-console (3.5.1)
actionview (>= 5.0) actionview (>= 5.0)
activemodel (>= 5.0) activemodel (>= 5.0)

4
config/application.rb
View File

@@ -40,14 +40,14 @@ module Neeto
end end
config.action_dispatch.default_headers = { config.action_dispatch.default_headers = {
'X-Frame-Options' => 'ALLOWALL' 'X-Frame-Options' => 'ALLOWALL'
} }
SecureHeaders::Configuration.default do |config| SecureHeaders::Configuration.default do |config|
config.x_frame_options = "ALLOWALL"
config.csp = { config.csp = {
# "meta" values. these will shape the header, but the values are not included in the header. # "meta" values. these will shape the header, but the values are not included in the header.
preserve_schemes: true, # default: false. Schemes are removed from host sources to save bytes and discourage mixed content. preserve_schemes: true, # default: false. Schemes are removed from host sources to save bytes and discourage mixed content.
# directive values: these values will directly translate into source directives # directive values: these values will directly translate into source directives
default_src: %w(https: 'self'), default_src: %w(https: 'self'),
base_uri: %w('self'), base_uri: %w('self'),