From 123babecf44ac0c075337d8d2108019c46b5c9a7 Mon Sep 17 00:00:00 2001 From: elijah Date: Thu, 11 Jul 2013 17:55:31 -0700 Subject: add header to prevent iframes --- app/controllers/application_controller.rb | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'app/controllers/application_controller.rb') diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 65d4861..9734a33 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -1,6 +1,7 @@ class ApplicationController < ActionController::Base protect_from_forgery before_filter :no_cache_header + before_filter :no_frame_header ActiveSupport.run_load_hooks(:application_controller, self) @@ -25,4 +26,11 @@ class ApplicationController < ActionController::Base response.headers["Expires"] = "0" end + # + # prevent app from being embedded in an iframe, for browsers that support x-frame-options. + # + def no_frame_header + response.headers["X-Frame-Options"] = "DENY" + end + end -- cgit v1.2.3