aboutsummaryrefslogtreecommitdiffstats
path: root/actionpack/test
diff options
context:
space:
mode:
authorGuillermo Iguaran <guilleiguaran@gmail.com>2017-12-09 15:41:55 -0500
committerGuillermo Iguaran <guilleiguaran@gmail.com>2017-12-09 15:41:55 -0500
commit5d7b70f4336d42eabfc403e9f6efceb88b3eff44 (patch)
treeba3ae0210fbd69372cd733d8f6f68de70ef4607e /actionpack/test
parent55d4cf2a9c1a6e77ed7aedb866e964039bb4a143 (diff)
downloadrails-5d7b70f4336d42eabfc403e9f6efceb88b3eff44.tar.gz
rails-5d7b70f4336d42eabfc403e9f6efceb88b3eff44.tar.bz2
rails-5d7b70f4336d42eabfc403e9f6efceb88b3eff44.zip
Add secure `X-Download-Options` and `X-Permitted-Cross-Domain-Policies` to default headers set.
Diffstat (limited to 'actionpack/test')
-rw-r--r--actionpack/test/controller/metal_test.rb2
-rw-r--r--actionpack/test/dispatch/response_test.rb8
2 files changed, 7 insertions, 3 deletions
diff --git a/actionpack/test/controller/metal_test.rb b/actionpack/test/controller/metal_test.rb
index c235c9df86..c3ebcb22b8 100644
--- a/actionpack/test/controller/metal_test.rb
+++ b/actionpack/test/controller/metal_test.rb
@@ -9,7 +9,7 @@ class MetalControllerInstanceTests < ActiveSupport::TestCase
end
end
- def test_response_has_default_headers
+ def test_response_does_not_have_default_headers
original_default_headers = ActionDispatch::Response.default_headers
ActionDispatch::Response.default_headers = {
diff --git a/actionpack/test/dispatch/response_test.rb b/actionpack/test/dispatch/response_test.rb
index c4ee3add2a..4e350162c9 100644
--- a/actionpack/test/dispatch/response_test.rb
+++ b/actionpack/test/dispatch/response_test.rb
@@ -311,13 +311,15 @@ class ResponseTest < ActiveSupport::TestCase
end
end
- test "read x_frame_options, x_content_type_options and x_xss_protection" do
+ test "read x_frame_options, x_content_type_options, x_xss_protection, x_download_options and x_permitted_cross_domain_policies" do
original_default_headers = ActionDispatch::Response.default_headers
begin
ActionDispatch::Response.default_headers = {
"X-Frame-Options" => "DENY",
"X-Content-Type-Options" => "nosniff",
- "X-XSS-Protection" => "1;"
+ "X-XSS-Protection" => "1;",
+ "X-Download-Options" => "noopen",
+ "X-Permitted-Cross-Domain-Policies" => "none"
}
resp = ActionDispatch::Response.create.tap { |response|
response.body = "Hello"
@@ -327,6 +329,8 @@ class ResponseTest < ActiveSupport::TestCase
assert_equal("DENY", resp.headers["X-Frame-Options"])
assert_equal("nosniff", resp.headers["X-Content-Type-Options"])
assert_equal("1;", resp.headers["X-XSS-Protection"])
+ assert_equal("noopen", resp.headers["X-Download-Options"])
+ assert_equal("none", resp.headers["X-Permitted-Cross-Domain-Policies"])
ensure
ActionDispatch::Response.default_headers = original_default_headers
end