github / secure_headers

Manages application of security headers with many safe defaults

github/secure_headers Issues

SecureHeaders middleware erases all cookies in Rack 3 due to \n joining
Updated 3 months ago1
RubyGems doesn't have latest version of this gem
Updated 5 months ago1
CSP Report-uri deprecated, replaced by report-to
Updated 10 months ago
`content_security_policy_nonce` calls Rails method so CSP does not contain nonce
Updated 10 months ago
test issue
Closed a year ago
test issue
Closed a year ago
Should x-xss-protection default to “0” instead of “1; mode=block”
Updated a year ago12
Guide for transitioning from secure_headers to vanilla rails csp
Updated a year ago3
How can I disable 'unsafe-inline' from script-src?
Closed a year ago1
jekyll integration
Closed 2 years ago3
Set `default-src` CSP Attribute to `none` by default
Updated 2 years ago1
Major Version 7.0.0
Updated 2 years ago1
Add simple static configuration option for bypassing application of all security headers
Updated 2 years ago5
URI::InvalidURIError: Invalid data URI
Closed 2 years ago1
Add require-trusted-types-for to CSP
Closed 2 years ago3
Installation instructions unclear
Closed 2 years ago1
Support CSP "double policies"
Updated 2 years ago
Webpacker `javascript_packs_with_chunks_tag` support
Updated 2 years ago2
How to display the csp setting at Chrome Response Headers?
Closed 4 years ago3
Why is CSP in report only mode blocking requests?
Closed 3 years ago3
Fix or remove support for automatically-computed CSP hashes
Updated 3 years ago13
Add support for CSP level 3
Closed 3 years ago3
Incorrect Version as latest release
Closed 3 years ago1
Replace cookie internals with CookiesAndCream
Closed 3 years ago2
bundler_audit found vulnerability in both v3.8.0 and v3.9.0
Closed 3 years ago10
Ignoring CSP on some formats
Closed 3 years ago1
how to allow all iframe for any sites?
Closed 3 years ago1
Setting SameSite cookie attribute conditionally
Closed 3 years ago4
omniauth and session
Closed 3 years ago5
CSP and google tag manager
Closed 3 years ago1
nonced tag helpers including nonce directive in csp has potential to break applications
Updated 3 years ago17
How to enforce secure cookies
Closed 3 years ago4
Validation on plugin-types does not allow for the empty directive
Updated 4 years ago
Ruby 2.7 compatibility
Closed 4 years ago
Fetch Metadata Browser Headers
Updated 4 years ago1
secure_headers is moving!
Closed 4 years ago1
Overriding the same override leads to ???
Closed 4 years ago
CSP ["https://*"] or ["http://*"] will be transferred to ["*"]
Closed 4 years ago3
DEPRECATION WARNING when set csp report_only: true, 3.9.0
Closed 4 years ago1
How to remove X-Frame-Options header from a response
Closed 5 years ago1
Filtering CSP entries to prevent bypassing rules
Closed 5 years ago8
6.1 is a breaking change due to removed HPKP
Closed 5 years ago3
README.md states Apache license, LICENSE file contains MIT license
Closed 5 years ago1
How to set SameSite to 'None' instead of Lax or Strict in 3.x?
Closed 5 years ago7
Allow for overriding cookie policy on a request by request basis
Closed 5 years ago4
Safari does not support worker-src
Closed 5 years ago4
Enable HSTS conditionally depending on domain
Closed 5 years ago2
twitter.com/crossdomain.xml
Closed 5 years ago1
Do you have to append unsafe-inline?
Closed 5 years ago5
Differentiate CSP headers by browser
Closed 5 years ago4