header_guard 0.1.2 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: af8346262e02cbf08a1efb6b7de1ea08d55f8d262be2801421a8f848796b96e4
-  data.tar.gz: f8a9d346ca8ba26ae507d99d1780a97be8499e9e5e537239de32fee4fb043ed8
+  metadata.gz: ea2dc2323334a13252e61e46ada4dbc84657d0a0f998ee5b1d4481d7c10c0a1b
+  data.tar.gz: 840fa96c9bb743cd59c4aea1a92adf80c116ccb6615af5c9f4d1a34ea3c16b6e
 SHA512:
-  metadata.gz: b08e3c213d232cb27d04eb8714f71894b9dfd9b0543d02ed971d9171551ecde1d57b2b57a938019facf9c5d69f568096453c7aa20b1a347e3067f2734dcc20b8
-  data.tar.gz: bb04592f757450600bae59a35b2572253642af6aa69af37e8c4e6724657b22d294a5aa6d859c39a2354262f42d13a9883be92a4b63d83d7b11321eb186578e7c
+  metadata.gz: 37cd5fd01fc7d57b0ad5ee1282115f5253552dcb93b9026bf78b8890b75d83d9781a3c85c821e37556432b94a2a9a36dda00eff1061582a51f12855e6b31c908
+  data.tar.gz: 18e56009b28987ccfcdbb78646d07fdf13f0ab9389c02e1d985aef41ec615f020c4012e4d01d3a69de8c48637e6b0de8e7b5ccdae81df15b9573f98b448864b0

data/CHANGELOG.md

@@ -7,7 +7,101 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-See `PLAN.md` for the remaining remediation work (P1–P5), targeted at 0.2.0.
+See `PLAN.md` for the remaining remediation work (P3–P5), targeted at 0.3.0.
+
+## [0.2.0] - 2026-09-12
+
+Widens which responses receive security headers and hardens every default. Read
+**Upgrading from 0.1.x** at the end of this entry before deploying.
+
+### Changed
+
+- **Standard headers are now applied to every response.** `Strict-Transport-Security`,
+  `X-Content-Type-Options`, `X-Frame-Options` and `Referrer-Policy` were previously
+  injected only on 2xx responses with an HTML content type, which excluded the responses
+  that need them most: JSON bodies got no `nosniff`, and the HTTP→HTTPS redirect — the
+  response where HSTS matters — got no HSTS. They now go on every response regardless
+  of status code or content type.
+
+- **The Content Security Policy is now applied to HTML responses of every status.**
+  Previously only 2xx HTML responses received a CSP, leaving 4xx/5xx error pages
+  unprotected. Error pages routinely reflect user input and are a classic XSS surface.
+  CSP remains restricted to HTML content types, as it governs documents only.
+
+- `application/xhtml+xml` is now treated as HTML for CSP purposes alongside `text/html`.
+
+- **`preload` removed from the default `Strict-Transport-Security`.** Preload is the
+  opt-in signal for the browser HSTS preload list, which hard-codes the apex domain and
+  every subdomain as HTTPS-only inside the browser itself; removal takes months. That is
+  a commitment to make explicitly, not one to acquire by adding a middleware. The default
+  is now `max-age=31536000; includeSubDomains`. Opt back in by overriding the header.
+
+- **Default CSP tightened to a strict same-origin baseline.** `style-src` was
+  `'self' 'unsafe-inline' https:` and `font-src` was `'self' https: data:`. Both are now
+  `'self'`. `https:` as a source allows content from any HTTPS origin and `'unsafe-inline'`
+  allows arbitrary inline styles — either lets an attacker who can inject markup load or
+  run content of their choosing, which is a weak default for something billed as a secure
+  baseline. Applications that need inline styles should add `'unsafe-inline'` deliberately
+  via `content_security_policy:`.
+
+- Default CSP directives are now separated by `"; "` rather than `";"` for readability.
+  Semantically identical.
+
+### Added
+
+- `html_only: true` option, which restores the 0.1.x behaviour of injecting nothing
+  unless the response is a 2xx with an HTML content type. This is a migration aid for
+  applications that depended on the narrower scope, not a recommended configuration.
+
+- **Four new default headers:**
+  - `Cross-Origin-Opener-Policy: same-origin-allow-popups` — isolates the browsing
+    context from cross-origin openers, mitigating XS-Leaks and Spectre-class attacks,
+    while still allowing popups the site itself opens (OAuth/OIDC providers in popup
+    mode) to talk back via `window.opener`. Chosen over the stricter `same-origin`
+    because the gem targets SSO applications, where popup-based client SDKs are common;
+    the only protection given up is against windows the site's own code chose to open.
+  - `Cross-Origin-Resource-Policy: same-origin` — stops other origins embedding this
+    site's resources via no-cors requests.
+  - `X-Permitted-Cross-Domain-Policies: none` — forbids Flash/Acrobat cross-domain
+    policy files.
+  - `Permissions-Policy` — denies `accelerometer`, `camera`, `geolocation`, `gyroscope`,
+    `magnetometer`, `microphone`, `payment` and `usb` unless explicitly enabled.
+
+### Removed
+
+- `block-all-mixed-content` from the default CSP. The directive is deprecated and was
+  removed from CSP Level 3; `upgrade-insecure-requests`, which remains, covers it.
+
+### Upgrading from 0.1.x
+
+Read this section before deploying — 0.2.0 tightens several defaults and some
+applications will need to opt back into behaviour they relied on.
+
+- **Standard headers now land on every response.** If your application sets its own
+  value for one of them on a non-HTML response (for example a different
+  `X-Frame-Options` on an API endpoint), HeaderGuard now overwrites it there too, as it
+  always has on HTML. Pass the desired value as a custom header option, or use
+  `html_only: true` while you migrate.
+- **Inline styles are now blocked by the default CSP.** If your pages use inline
+  `<style>` or `style=""` attributes (CSS-in-JS libraries commonly do), pass a
+  `content_security_policy:` that adds `'unsafe-inline'` to `style-src`, or better, move
+  to nonces.
+- **Third-party fonts and stylesheets are now blocked by the default CSP.** Add the
+  specific origins you use (e.g. `https://fonts.googleapis.com`) to `style-src` and
+  `font-src` rather than reinstating `https:`.
+- **Identity providers serving popup-based flows need to override
+  `Cross-Origin-Opener-Policy`.** The default `same-origin-allow-popups` keeps flows
+  where *your* site opens the popup working, but if your site *is* the popup (you are
+  the identity provider), the page the client opens must keep `window.opener`, which
+  requires `unsafe-none`. Redirect-based flows are unaffected either way.
+- **Assets embedded by other sites will be blocked by `Cross-Origin-Resource-Policy`.**
+  If your app serves images, scripts or fonts meant to load on other origins, override
+  with `cross-origin`.
+- **Features denied by `Permissions-Policy`** (camera, microphone, geolocation, payment,
+  and so on) must be re-enabled explicitly if your app uses them.
+- **HSTS preload is no longer set.** If you had already submitted your domain to the
+  preload list, add `preload` back via a custom header — otherwise the list's periodic
+  checks will flag the domain for removal.
 
 ## [0.1.2] - 2026-09-08
 
@@ -64,7 +158,8 @@ See `PLAN.md` for the remaining remediation work (P1–P5), targeted at 0.2.0.
   `X-Frame-Options`, `Referrer-Policy` and a configurable Content Security Policy,
   with `report_only` support.
 
-[Unreleased]: https://github.com/danielefrisanco/headerguard/compare/v0.1.2...HEAD
+[Unreleased]: https://github.com/danielefrisanco/headerguard/compare/v0.2.0...HEAD
+[0.2.0]: https://github.com/danielefrisanco/headerguard/compare/v0.1.2...v0.2.0
 [0.1.2]: https://github.com/danielefrisanco/headerguard/compare/v0.1.1...v0.1.2
 [0.1.1]: https://github.com/danielefrisanco/headerguard/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/danielefrisanco/headerguard/releases/tag/v0.1.0

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    header_guard (0.1.2)
+    header_guard (0.2.0)
       rack (~> 3.0)
 
 GEM

data/README.md

@@ -82,14 +82,18 @@ When integrating `HeaderGuard` into your project, you can pass an options hash t
 
 #### 1\. Overriding Standard Headers
 
-Any key/value pair passed to the middleware that matches a standard header will override the default value.
-
-| Header | Default Value | Purpose | 
- | ----- | ----- | ----- | 
-| `Strict-Transport-Security` | `max-age=31536000; includeSubDomains; preload` | Enforces HTTPS usage. | 
-| `X-Content-Type-Options` | `nosniff` | Prevents browser MIME-sniffing. | 
-| `X-Frame-Options` | `DENY` | Prevents clickjacking (set to SAMEORIGIN to allow framing on the same site). | 
-| `Referrer-Policy` | `strict-origin-when-cross-origin` | Controls referrer information sent with requests. | 
+Any key/value pair passed to the middleware that matches a standard header will override the default value. Header names are matched case-insensitively.
+
+| Header | Default Value | Purpose |
+| ----- | ----- | ----- |
+| `Strict-Transport-Security` | `max-age=31536000; includeSubDomains` | Enforces HTTPS usage. |
+| `X-Content-Type-Options` | `nosniff` | Prevents browser MIME-sniffing. |
+| `X-Frame-Options` | `DENY` | Prevents clickjacking (set to `SAMEORIGIN` to allow framing on the same site). |
+| `Referrer-Policy` | `strict-origin-when-cross-origin` | Controls referrer information sent with requests. |
+| `Cross-Origin-Opener-Policy` | `same-origin-allow-popups` | Isolates the browsing context from cross-origin openers (XS-Leaks, Spectre) while allowing popups you open. |
+| `Cross-Origin-Resource-Policy` | `same-origin` | Stops other origins embedding your resources via no-cors requests. |
+| `X-Permitted-Cross-Domain-Policies` | `none` | Forbids Flash/Acrobat cross-domain policy files. |
+| `Permissions-Policy` | `accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()` | Denies sensitive device features unless enabled. |
 
 **Example: Overriding X-Frame-Options and Referrer-Policy:**
 ```ruby
@@ -98,14 +102,55 @@ config.middleware.use HeaderGuard::Middleware,
   "X-Frame-Options" => "SAMEORIGIN",
   "Referrer-Policy" => "no-referrer"
 ```
+
+**Opting into HSTS preload.** The default deliberately omits `preload`. It is the signal for the [browser HSTS preload list](https://hstspreload.org/), which hard-codes your apex domain *and every subdomain* as HTTPS-only inside the browser, and removal takes months. Add it only once you've confirmed every subdomain serves HTTPS:
+
+```ruby
+config.middleware.use HeaderGuard::Middleware,
+  "Strict-Transport-Security" => "max-age=31536000; includeSubDomains; preload"
+```
+
+**`Cross-Origin-Opener-Policy` and popup-based auth.** The default `same-origin-allow-popups` means no cross-origin page can open your site and keep a handle on it, while popups *your* site opens — an OAuth/OIDC provider in popup mode — can still talk back via `window.opener`. Redirect-based flows are unaffected either way.
+
+Two situations need a different value:
+
+```ruby
+# Your site *is* the popup (you are the identity provider): the page the client
+# opens must keep window.opener, which requires disabling isolation on it.
+config.middleware.use HeaderGuard::Middleware, "Cross-Origin-Opener-Policy" => "unsafe-none"
+
+# You open no popups and want the strictest isolation available (also the
+# value required, together with COEP, for cross-origin isolated features such
+# as SharedArrayBuffer):
+config.middleware.use HeaderGuard::Middleware, "Cross-Origin-Opener-Policy" => "same-origin"
+```
+
+**Assets embedded by other sites and `Cross-Origin-Resource-Policy`.** `same-origin` prevents other origins from loading your images, scripts or fonts. If your app serves assets meant to be embedded elsewhere, set it to `cross-origin`.
 #### 2\. Custom Content Security Policy (CSP)
 
-You can define a custom CSP string to replace the secure default provided by HeaderGuard.
+The default CSP is a strict same-origin baseline:
+
+```
+default-src 'self'; base-uri 'self'; font-src 'self'; form-action 'self';
+frame-ancestors 'none'; object-src 'none'; script-src 'self'; style-src 'self';
+upgrade-insecure-requests
+```
+
+Resources may load only from your own origin; plugins, `<base>` tags and object embeds are blocked; inline scripts and styles are not permitted. Most real applications will need to extend this. You can define a custom CSP string to replace the default:
 
 ```ruby
-custom_csp = "default-src 'self'; script-src 'self' [https://trusted.cdn.com](https://trusted.cdn.com);"
+custom_csp = "default-src 'self'; script-src 'self' https://trusted.cdn.com;"
 use HeaderGuard::Middleware, content_security_policy: custom_csp
 
+```
+
+When extending the policy, add the specific origins you need rather than broad sources. `https:` as a source allows content from *any* HTTPS origin, and `'unsafe-inline'` allows any inline style or script — both let an attacker who can inject markup load or run content of their choosing. If you must allow inline styles (many CSS-in-JS libraries need it), do so knowingly:
+
+```ruby
+# Allowing inline styles, explicitly.
+use HeaderGuard::Middleware,
+  content_security_policy: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none'; frame-ancestors 'none'"
+
 ```
 #### 3\. Report-Only Mode
 
@@ -116,18 +161,29 @@ To test a new CSP without enforcing it, set the report\_only option to true. Thi
 config.middleware.use HeaderGuard::Middleware, report_only: true
 
 ```
+#### 4\. Restricting to HTML Responses (legacy behaviour)
+
+By default HeaderGuard applies its standard headers to **every** response and the CSP to every **HTML** response, whatever the status code (see *How It Works* below). Versions before 0.2.0 injected nothing unless the response was a 2xx with an HTML content type. If you depend on that narrower behaviour, set `html_only`:
+
+```ruby
+# 0.1.x behaviour: inject only on 2xx text/html responses.
+config.middleware.use HeaderGuard::Middleware, html_only: true
+
+```
+This is a migration aid, not a recommended configuration: it leaves JSON responses without `X-Content-Type-Options`, redirects without HSTS, and error pages without a CSP.
 
 How It Works
 ------------
 
-HeaderGuard hooks into the Rack request lifecycle and performs the following actions on responses with a 2xx status code and a Content-Type of text/html:
+HeaderGuard hooks into the Rack request lifecycle and, on every response passing through it:
 
 1.  **Header Merging:** It takes the default security headers and merges them with any custom headers supplied during initialization, ensuring user configuration takes precedence.
     
-2.  **Injection:** It injects the final set of standard security headers.
+2.  **Standard Header Injection:** It injects every header in the table above (HSTS, `X-Content-Type-Options`, `X-Frame-Options`, `Referrer-Policy`, the cross-origin isolation headers and `Permissions-Policy`) on **every** response, regardless of status code or content type. HSTS matters most on the HTTP→HTTPS redirect, and `nosniff` exists precisely to protect non-HTML bodies such as JSON.
     
-3.  **CSP Injection:** It injects the configured Content Security Policy, using either the standard enforcement header or the Report-Only header.
+3.  **CSP Injection:** It injects the configured Content Security Policy — using either the standard enforcement header or the Report-Only header — on every response whose `Content-Type` is `text/html` or `application/xhtml+xml`, **including error pages**. Error pages routinely reflect user input and are a classic XSS surface, so they need a policy at least as much as a 200 does. Non-HTML responses do not receive a CSP, as it governs documents only.
     
+Header names are handled case-insensitively and always written in lowercase, as the Rack 3 SPEC requires, so both Rack 2 and Rack 3 style applications are supported.
 
 Development
 -----------

data/lib/header_guard/middleware.rb

@@ -7,7 +7,24 @@ module HeaderGuard
   # requires response header keys to be lowercase, while Rack 2 applications
   # conventionally use capitalized keys, so this middleware reads incoming
   # headers case-insensitively and always writes lowercase keys.
+  #
+  # Which responses receive which headers:
+  #
+  # * The standard headers (HSTS, X-Content-Type-Options, X-Frame-Options,
+  #   Referrer-Policy) are applied to every response, regardless of status or
+  #   content type. HSTS matters most on the HTTP->HTTPS redirect, and nosniff
+  #   exists precisely to protect non-HTML bodies such as JSON.
+  # * The Content Security Policy governs a document, so it is applied only to
+  #   HTML responses -- but on every status. Error pages reflect user input and
+  #   are a classic XSS surface, so they need a policy at least as much as a
+  #   200 does.
+  #
+  # Passing `html_only: true` restores the 0.1.x behaviour, where nothing was
+  # injected unless the response was a 2xx with an HTML content type.
   class Middleware
+    # Content types treated as HTML documents for the purpose of applying CSP.
+    HTML_CONTENT_TYPES = ["text/html", "application/xhtml+xml"].freeze
+
     # Initializes the middleware. It merges user-defined options over defaults.
     #
     # @param app [Object] The next application in the Rack stack.
@@ -21,6 +38,7 @@ module HeaderGuard
       # Extract special configuration settings
       custom_csp = config.delete(:content_security_policy)
       @report_only = config.delete(:report_only) || false
+      @html_only = config.delete(:html_only) || false
 
       # 1. Start with DEFAULT_HEADERS (from header_guard.rb)
       # 2. Merge remaining options (which are custom headers) over the defaults,
@@ -40,32 +58,54 @@ module HeaderGuard
     def call(env)
       status, headers, body = @app.call(env)
 
-      # Only inject headers on successful (2xx) responses with HTML content.
-      # Exclude redirects, errors, and non-HTML assets (like JSON or images).
-      if (200..299).include?(status) && html?(headers)
-        # Inject the standard headers
+      html = html?(headers)
+
+      if apply_standard_headers?(status, html)
         @headers.each do |key, value|
           # We use assignment here, not `||=`, to ensure the middleware
           # overwrites any headers set by the application before it,
           # adhering to the strong security posture.
           assign(headers, key, value)
         end
-
-        # Inject the configured CSP header
-        assign(headers, @csp_header_key, @csp_value)
       end
 
+      assign(headers, @csp_header_key, @csp_value) if apply_csp?(status, html)
+
       [status, headers, body]
     end
 
     private
 
+    # Standard headers go on every response. In html_only mode they are
+    # restricted to 2xx HTML, as in 0.1.x.
+    def apply_standard_headers?(status, html)
+      return true unless @html_only
+
+      success?(status) && html
+    end
+
+    # CSP goes on every HTML response regardless of status. In html_only mode
+    # it is restricted to 2xx HTML, as in 0.1.x.
+    def apply_csp?(status, html)
+      return false unless html
+      return true unless @html_only
+
+      success?(status)
+    end
+
+    def success?(status)
+      (200..299).cover?(status)
+    end
+
     def normalize_key(key)
       key.to_s.downcase
     end
 
     def html?(headers)
-      fetch_header(headers, "content-type")&.include?("text/html")
+      content_type = fetch_header(headers, "content-type")
+      return false unless content_type
+
+      HTML_CONTENT_TYPES.any? { |type| content_type.include?(type) }
     end
 
     # Rack 3 responses key headers in lowercase; Rack 2 applications typically

data/lib/header_guard/version.rb

@@ -2,5 +2,5 @@
 
 module HeaderGuard
   # The current version of the HeaderGuard gem.
-  VERSION = "0.1.2"
+  VERSION = "0.2.0"
 end

data/lib/header_guard.rb

@@ -4,38 +4,71 @@ require_relative "header_guard/version"
 require_relative "header_guard/middleware"
 
 module HeaderGuard
-  # Standard security headers applied by default.
+  # Standard security headers applied to every response by default.
   DEFAULT_HEADERS = {
-    # Strictly enforce HTTPS, preventing protocol downgrade attacks.
-    # 1 year (31536000 seconds) max-age is standard best practice.
-    "Strict-Transport-Security"   => "max-age=31536000; includeSubDomains; preload",
-    # Prevent the browser from trying to guess the content type,
-    # which can lead to XSS attacks if it misinterprets a file as a script.
-    "X-Content-Type-Options"      => "nosniff",
-    # Tells the browser which referrer information to include with requests.
-    # origin-when-cross-origin is a good balance of security and functionality.
-    "X-Frame-Options"             => "DENY",
-    # Tells the browser which referrer information to include with requests.
-    # origin-when-cross-origin is a good balance of security and functionality.
-    "Referrer-Policy"             => "strict-origin-when-cross-origin"
+    # Strictly enforce HTTPS for one year, including subdomains, preventing
+    # protocol downgrade attacks.
+    #
+    # `preload` is deliberately omitted. It is the opt-in signal for the browser
+    # HSTS preload list, which hard-codes the apex domain and every subdomain as
+    # HTTPS-only inside the browser itself, and removal from the list takes
+    # months. That is a commitment to make explicitly, not one to acquire by
+    # adding a middleware. Opt in with:
+    #   "Strict-Transport-Security" => "max-age=31536000; includeSubDomains; preload"
+    "Strict-Transport-Security"          => "max-age=31536000; includeSubDomains",
+    # Prevent the browser from guessing the content type, which can lead to XSS
+    # if it misinterprets a file as a script.
+    "X-Content-Type-Options"             => "nosniff",
+    # Forbid rendering this site inside a frame, preventing clickjacking. The
+    # legacy counterpart of the CSP `frame-ancestors` directive below.
+    "X-Frame-Options"                    => "DENY",
+    # Send the full referrer only on same-origin requests, and just the origin
+    # cross-origin; a good balance of security and functionality.
+    "Referrer-Policy"                    => "strict-origin-when-cross-origin",
+    # Put this site in its own browsing context group, so a cross-origin window
+    # that opens it cannot hold a reference to it. Mitigates XS-Leaks and
+    # Spectre-class attacks.
+    #
+    # "same-origin-allow-popups" rather than the stricter "same-origin": it
+    # keeps the protection that matters (nobody can open *this* site and keep a
+    # handle on it) while still letting popups this site opens -- an OAuth/OIDC
+    # provider in popup mode, say -- talk back via `window.opener`. The only
+    # thing given up is isolation from windows this site's own code chose to
+    # open, and `noopener` covers that where it matters.
+    #
+    # If this site *is* the popup (you are the identity provider), the page the
+    # client opens needs "unsafe-none". Redirect-based flows are unaffected.
+    "Cross-Origin-Opener-Policy"         => "same-origin-allow-popups",
+    # Prevent other origins from embedding this site's resources (images,
+    # scripts, fonts) via no-cors requests. Override with "cross-origin" on
+    # assets that are meant to be embedded elsewhere.
+    "Cross-Origin-Resource-Policy"       => "same-origin",
+    # Forbid Adobe Flash / Acrobat cross-domain policy files.
+    "X-Permitted-Cross-Domain-Policies"  => "none",
+    # Deny access to sensitive device features unless explicitly enabled.
+    "Permissions-Policy"                 => "accelerometer=(), camera=(), geolocation=(), gyroscope=(), " \
+                                            "magnetometer=(), microphone=(), payment=(), usb=()"
   }.freeze
 
-  # Default Content Security Policy. This is a secure baseline.
-  # This serves as a strong baseline, allowing resources only from the same origin ('self'),
-  # and explicitly blocking all plugins, base tags, and object embeds.
+  # Default Content Security Policy: a strict same-origin baseline.
   #
-  # Note: A real application will likely need to customize this heavily
-  # to allow CDNs, analytics scripts, etc.
-  DEFAULT_CSP = (
-    "default-src 'self';" \
-    "base-uri 'self';" \
-    "font-src 'self' https: data:;" \
-    "form-action 'self';" \
-    "frame-ancestors 'none';" \
-    "object-src 'none';" \
-    "script-src 'self';" \
-    "style-src 'self' 'unsafe-inline' https:;" \
-    "upgrade-insecure-requests;" \
-    "block-all-mixed-content"
-  ).freeze
+  # Resources may load only from this origin; plugins, <base> tags and object
+  # embeds are blocked outright; inline scripts and styles are not permitted.
+  #
+  # A real application will need to extend this -- to allow a CDN, an analytics
+  # script, inline styles -- but should do so by adding the specific origins or
+  # nonces it needs, not by reintroducing broad sources such as `https:` or
+  # `'unsafe-inline'`. Both let an attacker who can inject markup load or run
+  # content from an origin of their choosing.
+  DEFAULT_CSP = [
+    "default-src 'self'",
+    "base-uri 'self'",
+    "font-src 'self'",
+    "form-action 'self'",
+    "frame-ancestors 'none'",
+    "object-src 'none'",
+    "script-src 'self'",
+    "style-src 'self'",
+    "upgrade-insecure-requests"
+  ].join("; ").freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: header_guard
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.2.0
 platform: ruby
 authors:
 - Gemini AI
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2026-09-08 00:00:00.000000000 Z
+date: 2026-09-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack