rails-profiler 0.30.5 → 0.30.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 04defc47e71c610492ff23fbce13ebf669f459a1cac74c5933200bdf4d52365c
-  data.tar.gz: d99cf7c5531fd369aa8c9367d95b0a5314f71f38de6ed64a7c81a9693f69566a
+  metadata.gz: e7a2ea61f4463670763c8c3c2d92f98a1f4ff2917fb9a2f5e0d245ea1860d2f1
+  data.tar.gz: ba467072b67f027565a29c99f458cd959933de512cdfa054ddde052d3e65ddb1
 SHA512:
-  metadata.gz: '09ba67258286ddc275d2d1cc36234dd8f0e7d24783034dd3959c666b41d96bb334d5c38d720ceca2254d205449094aa57cac9de6afb1842e3437fbd2d238eac3'
-  data.tar.gz: '0936d7ca150be6a80809739a2d9b94f77c51c80fad8796bb01d93fb2ca0047a5da3eb4ae832f9567c381bd3dcaacad3000b0273664362570306060c8b3b3eeec'
+  metadata.gz: b2a1049428bab86d06ba54bba7cd373bfc3ebe606137bd2e6bfda46d5b1501c10574ebcec632125efd9e5c6b6a0be2d11c763b15e670a06aaaac384c0e028c6e
+  data.tar.gz: 561590eb7eadc20139ea79a0005efefbf9de88da0010db4ae20903360d3199342ba9648fe9d6d4bc1452c62e18c61f47311f19bb78f68a3307791f3089a11f06

data/CHANGELOG.md

@@ -19,6 +19,49 @@ every commit of every tag interval is accounted for one way or the other.
 
 ## [Unreleased]
 
+## [0.30.6] - 2026-10-03
+
+<!-- stamped -->
+
+### Security
+
+- **Access control:** Check `authorization_mode` on every page and endpoint of the profiler (UI,
+  API, server-sent events, test runner, toolbar), answering `403` otherwise. It used to decide only
+  which requests were captured: with `:allow_authorized` and a block that refused everybody, the API
+  still listed and deleted profiles and wrote `ENV`. The gem's static JS and CSS stay public.
+- **Access control:** The new default `authorization_mode`, `:allow_local`, only lets in requests
+  made from this machine: a loopback `REMOTE_ADDR`, no forwarding header naming a remote client, and
+  a local `Host` (or one listed in `config.hosts`), against DNS rebinding; the test environment
+  also accepts the reserved hosts `www.example.com`, `example.com` and `example.org`, so the
+  application's request specs are still captured. It also decides
+  which requests are captured, and logs the reason for a refusal once per process. The previous
+  default, `:allow_all`, let anybody who could reach the application read and change everything.
+- **Access control:** API requests that change something (including a form `POST` turned into
+  another verb by `_method`) must carry an `X-Profiler-Request` header or a CSRF token, so that a
+  page on another site can no longer trigger them, even when the application turns
+  `allow_forgery_protection` off. The dashboard, the toolbar and the cluster send the header.
+- **Access control:** CORS is off by default (`extension_cors_enabled = false`,
+  `cors_allowed_origins = []`), and `Access-Control-Allow-Origin: *` is never sent to a request
+  carrying a cookie or an `Authorization` header. It used to be `*` for everybody.
+- **Access control:** Profiler pages may only be framed by the profiler itself and by the Chrome
+  extension's DevTools panel (`frame-ancestors 'self' chrome-extension: devtools:`, configurable
+  with the new `frame_ancestors` option), and send `X-Frame-Options: SAMEORIGIN`. Any website could
+  frame them, and with `?embed=true` a profile page carried no framing protection at all.
+- **Upgrading:** Nothing to do when you browse the profiler from the machine that runs Rails. Each
+  previous behavior can be restored in `config/initializers/profiler.rb`:
+  - Docker, a VM or a remote proxy: admit your network with `config.authorization_mode =
+    :allow_authorized` and an `authorize_with` block reading `REMOTE_ADDR` (example in the README), or
+    go back to `config.authorization_mode = :allow_all`, which offers no protection.
+  - A cluster whose master and slaves run on different machines: each side admits the other's address
+    the same way.
+  - Your own scripts calling the API: send `X-Profiler-Request: 1`, or set
+    `config.api_forgery_protection = false`.
+  - Cross-origin clients: `config.extension_cors_enabled = true` and
+    `config.cors_allowed_origins = ["https://your.origin"]`. `["*"]` restores the behavior before
+    0.30.6 and reopens the profiler to every website you visit: under `:allow_local` or `:allow_all`,
+    any page open in your browser can read its data and change it.
+  - Framing by other sites: `config.frame_ancestors = ["'self'", "http:", "https:"]`.
+
 ## [0.30.5] - 2026-10-03
 
 <!-- stamped -->

data/app/assets/builds/profiler-toolbar.js

@@ -4167,10 +4167,11 @@
     const { method, params, data, headers = {}, signal } = config;
     const url = resolvedUrl;
     const qs = params ? "?" + new URLSearchParams(Object.entries(params).map(([k3, v3]) => [k3, String(v3)])).toString() : "";
+    const baseHeaders = { "X-Profiler-Request": "1", ...headers };
     const res = await fetch(url + qs, {
       method,
       signal,
-      headers: data !== void 0 ? { "Content-Type": "application/json", ...headers } : headers,
+      headers: data !== void 0 ? { "Content-Type": "application/json", ...baseHeaders } : baseHeaders,
       body: data !== void 0 ? JSON.stringify(data) : void 0
     });
     if (res.status === 204) return {};

data/app/assets/builds/profiler.js

@@ -3456,10 +3456,11 @@
     const { method, params, data, headers = {}, signal } = config;
     const url = resolvedUrl;
     const qs = params ? "?" + new URLSearchParams(Object.entries(params).map(([k3, v3]) => [k3, String(v3)])).toString() : "";
+    const baseHeaders = { "X-Profiler-Request": "1", ...headers };
     const res = await fetch(url + qs, {
       method,
       signal,
-      headers: data !== void 0 ? { "Content-Type": "application/json", ...headers } : headers,
+      headers: data !== void 0 ? { "Content-Type": "application/json", ...baseHeaders } : baseHeaders,
       body: data !== void 0 ? JSON.stringify(data) : void 0
     });
     if (res.status === 204) return {};

data/app/controllers/profiler/api/ajax_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class AjaxController < ApplicationController
-      skip_before_action :verify_authenticity_token, only: [:link]
-
       def link
         parent_token = params[:parent_token]
         child_token = params[:child_token]

data/app/controllers/profiler/api/cluster_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class ClusterController < Profiler::ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def register
         name = params[:name].to_s
         url  = params[:url].to_s

data/app/controllers/profiler/api/console_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class ConsoleController < ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def index
         limit  = (params[:limit]  || 50).to_i
         offset = (params[:offset] || 0).to_i

data/app/controllers/profiler/api/env_vars_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class EnvVarsController < ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def show
         variables = ENV.to_h.sort.to_h
         overrides = Profiler.env_override_store.all_overrides

data/app/controllers/profiler/api/events_controller.rb

@@ -4,7 +4,6 @@ module Profiler
   module Api
     class EventsController < Profiler::ApplicationController
       include ActionController::Live
-      skip_before_action :verify_authenticity_token
 
       def subscribe
         response.headers["Content-Type"]      = "text/event-stream"

data/app/controllers/profiler/api/explain_controller.rb

@@ -5,8 +5,6 @@ require "profiler/explain_runner"
 module Profiler
   module Api
     class ExplainController < ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def create
         unless Profiler.configuration.enabled
           return render json: { error: "EXPLAIN is only available when the profiler is enabled" }, status: :forbidden

data/app/controllers/profiler/api/function_profiling_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class FunctionProfilingController < ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def show
         render json: {
           enabled:    Profiler.function_profiling_enabled,

data/app/controllers/profiler/api/jobs_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class JobsController < ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def index
         limit  = (params[:limit]  || 50).to_i
         offset = (params[:offset] || 0).to_i

data/app/controllers/profiler/api/outbound_http_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class OutboundHttpController < ApplicationController
-      skip_before_action :verify_authenticity_token
-
       # GET /_profiler/api/outbound_http
       def index
         limit = (params[:limit] || 200).to_i

data/app/controllers/profiler/api/profiles_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class ProfilesController < ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def index
         limit  = (params[:limit]  || 50).to_i
         offset = (params[:offset] || 0).to_i

data/app/controllers/profiler/api/slave_proxy_controller.rb

@@ -5,8 +5,6 @@ require_relative "../../../../lib/profiler/cluster/slave_proxy"
 module Profiler
   module Api
     class SlaveProxyController < Profiler::ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def forward
         proxy = Cluster::SlaveProxy.new(params[:slave_name])
         sub_path = params[:path].to_s

data/app/controllers/profiler/api/test_runner_controller.rb

@@ -8,8 +8,6 @@ module Profiler
     class TestRunnerController < ApplicationController
       include ActionController::Live
 
-      skip_before_action :verify_authenticity_token
-
       def files
         framework = params[:framework]
         tree = Profiler::TestRunner::Discovery.files(framework: framework)

data/app/controllers/profiler/api/tests_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class TestsController < ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def index
         limit  = (params[:limit]  || 50).to_i
         offset = (params[:offset] || 0).to_i

data/app/controllers/profiler/api/toolbar_controller.rb

@@ -3,7 +3,6 @@
 module Profiler
   module Api
     class ToolbarController < Profiler::ApplicationController
-      skip_before_action :verify_authenticity_token
       skip_before_action :check_authorization
 
       def show

data/app/controllers/profiler/application_controller.rb

@@ -2,11 +2,12 @@
 
 module Profiler
   class ApplicationController < ActionController::Base
-    protect_from_forgery with: :exception
-
     layout "profiler/application"
 
     before_action :check_authorization
+    before_action :authorize_request
+    # Declared after the access checks, so that an unauthorized request gets its 403 first.
+    protect_from_forgery with: :exception
 
     private
 
@@ -16,6 +17,36 @@ module Profiler
       end
     end
 
+    def authorize_request
+      return if Profiler.configuration.authorized?(request)
+
+      deny("Not authorized to access the profiler")
+    end
+
+    # Decided by the profiler's own setting, not by the application's allow_forgery_protection,
+    # which the config/environments/test.rb generated by Rails turns off.
+    def protect_against_forgery?
+      Profiler.configuration.api_forgery_protection ? true : false
+    end
+
+    # Rails' token, or the header every profiler client sends. A third-party page cannot add a
+    # custom header without a CORS preflight, which is refused unless an origin was allowed.
+    def verified_request?
+      super || request.headers[Profiler::FORGERY_PROTECTION_HEADER].present?
+    end
+
+    def handle_unverified_request
+      deny("Missing #{Profiler::FORGERY_PROTECTION_HEADER} header or CSRF token")
+    end
+
+    def deny(message)
+      if controller_path.start_with?("profiler/api/")
+        render json: { error: message }, status: :forbidden
+      else
+        render plain: message, status: :forbidden
+      end
+    end
+
     def build_child_jobs(profile)
       storage = @resolved_storage || Profiler.storage
       storage.find_by_parent(profile.token)

data/app/controllers/profiler/assets_controller.rb

@@ -2,8 +2,11 @@
 
 module Profiler
   class AssetsController < ApplicationController
+    # The gem's own static JS and CSS: no application data, cached publicly. Every piece of
+    # data they display comes from the API, which keeps the authorization check.
     skip_before_action :verify_authenticity_token
     skip_before_action :check_authorization
+    skip_before_action :authorize_request
 
     def toolbar_js
       path = Profiler::Engine.root.join("app", "assets", "builds", "profiler-toolbar.js")

data/app/controllers/profiler/profiles_controller.rb

@@ -2,8 +2,6 @@
 
 module Profiler
   class ProfilesController < ApplicationController
-    before_action :allow_iframe_embedding, only: [:show], if: -> { params[:embed] == "true" }
-
     def index
       limit = params[:limit]&.to_i || 50
       offset = params[:offset]&.to_i || 0
@@ -158,13 +156,6 @@ module Profiler
       end
     end
 
-    def allow_iframe_embedding
-      response.headers.delete('X-Frame-Options')
-      # Don't set frame-ancestors CSP to allow Chrome extensions to embed
-      # Mark that CSP should not be set by middleware
-      request.env['profiler.skip_csp'] = true
-    end
-
     def filter_profiles(profiles)
       filtered = profiles
 

data/lib/profiler/cluster/master_client.rb

@@ -24,7 +24,8 @@ module Profiler
         config = Profiler.configuration
         uri = URI("#{config.master_url}/_profiler/api/cluster/register")
         body = { name: config.resolved_name, url: config.self_url }.to_json
-        resp = Net::HTTP.post(uri, body, "Content-Type" => "application/json")
+        resp = Net::HTTP.post(uri, body, "Content-Type" => "application/json",
+                                          Profiler::FORGERY_PROTECTION_HEADER => "1")
         unless resp.code.to_i.between?(200, 299)
           raise "Master returned #{resp.code}: #{resp.body.to_s.slice(0, 200)}"
         end
@@ -36,7 +37,8 @@ module Profiler
         config = Profiler.configuration
         uri = URI("#{config.master_url}/_profiler/api/cluster/heartbeat")
         body = { name: config.resolved_name }.to_json
-        resp = Net::HTTP.post(uri, body, "Content-Type" => "application/json")
+        resp = Net::HTTP.post(uri, body, "Content-Type" => "application/json",
+                                          Profiler::FORGERY_PROTECTION_HEADER => "1")
         raise "Heartbeat rejected #{resp.code}" unless resp.code.to_i.between?(200, 299)
       end
 

data/lib/profiler/cluster/slave_proxy.rb

@@ -86,6 +86,7 @@ module Profiler
       end
 
       def request(uri, req)
+        req[Profiler::FORGERY_PROTECTION_HEADER] = "1"
         resp = Net::HTTP.start(uri.hostname, uri.port,
                                open_timeout: @open_timeout, read_timeout: @read_timeout,
                                use_ssl: uri.scheme == "https") do |http|

data/lib/profiler/configuration.rb

@@ -1,13 +1,20 @@
 # frozen_string_literal: true
 
+require_relative "local_request"
+
 module Profiler
+  # Header the profiler's own clients send on every request. A page on another origin cannot
+  # add it without a CORS preflight, which the profiler does not grant by default, so its
+  # presence proves the request is not a cross-site forgery.
+  FORGERY_PROTECTION_HEADER = "X-Profiler-Request"
+
   class Configuration
     attr_accessor :enabled, :storage_options, :collectors,
                   :skip_paths, :slow_query_threshold, :max_queries_warning,
                   :track_memory, :memory_warning_threshold,
                   :mcp_enabled, :mcp_transport, :mcp_port,
                   :authorization_mode, :max_profiles, :extension_cors_enabled,
-                  :cors_allowed_origins,
+                  :cors_allowed_origins, :api_forgery_protection, :frame_ancestors,
                   :track_ajax, :ajax_skip_paths,
                   :track_http, :slow_http_threshold, :http_skip_hosts, :http_backtrace_depth,
                   :track_jobs,
@@ -35,11 +42,16 @@ module Profiler
       @mcp_enabled = false
       @mcp_transport = :stdio
       @mcp_port = 3001
-      @authorization_mode = :allow_all
+      @authorization_mode = :allow_local
       @authorize_block = nil
       @max_profiles = 100
-      @extension_cors_enabled = true
-      @cors_allowed_origins = ["*"]
+      @extension_cors_enabled = false
+      @cors_allowed_origins = []
+      @api_forgery_protection = true
+      # The Chrome extension shows the profiler in a DevTools panel: an iframe inside a
+      # chrome-extension:// page, itself inside the devtools://devtools front end. Chrome
+      # checks frame-ancestors against every ancestor, so both schemes are needed.
+      @frame_ancestors = ["'self'", "chrome-extension:", "devtools:"]
       @track_ajax = true
       @ajax_skip_paths = [/^\/_profiler/]
       @track_http = true
@@ -87,6 +99,12 @@ module Profiler
       case @authorization_mode
       when :allow_all
         true
+      when :allow_local
+        reason = LocalRequest.denial_reason(request)
+        return true if reason.nil?
+
+        LocalRequest.warn_once(reason)
+        false
       when :allow_authorized
         @authorize_block ? @authorize_block.call(request) : false
       else

data/lib/profiler/local_request.rb

@@ -0,0 +1,163 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+
+module Profiler
+  # Decides whether a request comes from this machine, for authorization_mode :allow_local.
+  #
+  # The client address is read from REMOTE_ADDR only. Forwarding headers (X-Forwarded-For,
+  # X-Real-IP, Forwarded, X-Forwarded-Host) can be forged, so they never grant access: they
+  # can only refuse it, when a local reverse proxy reports a remote client. The Host header
+  # has to be a local name, or one the application allows in config.hosts, which defeats DNS
+  # rebinding: a rebound page reaches 127.0.0.1 under the attacker's own domain name. The
+  # test environment also accepts the default hosts of rack-test and of Rails integration
+  # tests, reserved names (RFC 2606) that no attacker can point at a server of his own.
+  module LocalRequest
+    FORWARDING_HEADERS = {
+      "HTTP_X_FORWARDED_FOR" => "X-Forwarded-For",
+      "HTTP_X_REAL_IP" => "X-Real-IP",
+      "HTTP_FORWARDED" => "Forwarded"
+    }.freeze
+
+    TEST_HOSTS = %w[www.example.com example.com example.org].freeze
+
+    @warned = false
+    @warn_mutex = Mutex.new
+
+    class << self
+      # Returns nil when the request is local, otherwise a sentence naming the cause.
+      def denial_reason(request)
+        remote_addr = request.get_header("REMOTE_ADDR").to_s
+        unless loopback_address?(remote_addr)
+          return "REMOTE_ADDR #{remote_addr.empty? ? "(missing)" : remote_addr} is not a loopback address"
+        end
+
+        FORWARDING_HEADERS.each do |key, name|
+          value = request.get_header(key)
+          next if value.nil? || value.empty?
+
+          nodes = key == "HTTP_FORWARDED" ? forwarded_param(value, "for") : value.split(",")
+          remote = nodes.map { |node| strip_port(node) }.find { |address| !loopback_address?(address) }
+          return "the #{name} header reports a non-local client (#{remote})" if remote
+        end
+
+        host_denial_reason(request)
+      end
+
+      def local?(request)
+        denial_reason(request).nil?
+      end
+
+      # Logs why a request was refused, once per process, so that an application running in
+      # Docker does not just stop being profiled with no explanation.
+      def warn_once(reason)
+        @warn_mutex.synchronize do
+          return if @warned
+
+          @warned = true
+        end
+
+        message = "[Profiler] Request refused or not profiled by authorization_mode :allow_local: #{reason}. " \
+                  "The profiler only serves and captures requests made from this machine. " \
+                  "If the application runs in Docker or behind a remote proxy, either set " \
+                  "config.authorization_mode = :allow_authorized with a config.authorize_with block " \
+                  "that admits your network (see the Access control section of the README), or set " \
+                  "config.authorization_mode = :allow_all, which offers no protection at all. " \
+                  "This message is logged once per process."
+        if defined?(Rails) && Rails.respond_to?(:logger) && Rails.logger
+          Rails.logger.warn(message)
+        else
+          warn(message)
+        end
+      end
+
+      def reset_warning!
+        @warn_mutex.synchronize { @warned = false }
+      end
+
+      def loopback_address?(value)
+        address = value.to_s.strip
+        address = address[1..-2] if address.start_with?("[") && address.end_with?("]")
+        # Only an IPv6 address carries a zone identifier ("fe80::1%eth0").
+        address = address.sub(/%.*\z/, "") if address.include?(":")
+        return false if address.empty?
+
+        ip = IPAddr.new(address)
+        ip = ip.native if ip.ipv6? && ip.ipv4_mapped?
+        ip.loopback?
+      rescue IPAddr::Error
+        false
+      end
+
+      private
+
+      def host_denial_reason(request)
+        # A request with no Host header does not come from a browser, so it cannot be a
+        # rebound page; REMOTE_ADDR alone decides.
+        raw_host = request.get_header("HTTP_HOST").to_s
+        unless raw_host.empty?
+          host = host_name(raw_host)
+          return "the Host header #{host.inspect} is not a local name" unless allowed_host?(host)
+        end
+
+        forwarded_hosts = request.get_header("HTTP_X_FORWARDED_HOST").to_s.split(",")
+        remote = forwarded_hosts.map { |h| host_name(h) }.find { |h| !allowed_host?(h) }
+        return "the X-Forwarded-Host header #{remote.inspect} is not a local name" if remote
+
+        forwarded = request.get_header("HTTP_FORWARDED").to_s
+        remote = forwarded_param(forwarded, "host").map { |h| host_name(h) }.find { |h| !allowed_host?(h) }
+        return "the Forwarded header names a non-local host (#{remote.inspect})" if remote
+
+        nil
+      end
+
+      def test_environment?
+        defined?(Rails) && Rails.respond_to?(:env) && Rails.env.test?
+      end
+
+      # Values of one parameter (for=, host=) of a Forwarded header (RFC 7239), quotes removed.
+      def forwarded_param(value, param)
+        value.split(/[,;]/).filter_map do |pair|
+          name, node = pair.split("=", 2)
+          next unless name.to_s.strip.casecmp?(param)
+
+          node.to_s.strip.delete_prefix('"').delete_suffix('"')
+        end
+      end
+
+      # "127.0.0.1:5555" -> "127.0.0.1", "[::1]:5555" -> "::1", "localhost:3000" -> "localhost".
+      # Any other form, a bare IPv6 address included, is returned as is: a malformed value is
+      # then refused unless it is local by itself.
+      def strip_port(value)
+        value = value.to_s.strip
+        match = value.match(/\A\[([^\]]+)\](?::\d+)?\z/) || value.match(/\A([^:]+)(?::\d+)?\z/)
+        match ? match[1] : value
+      end
+
+      def host_name(value)
+        strip_port(value).downcase.chomp(".")
+      end
+
+      def allowed_host?(host)
+        return false if host.empty?
+        return true if host == "localhost" || host.end_with?(".localhost")
+        return true if loopback_address?(host)
+        return true if test_environment? && TEST_HOSTS.include?(host)
+
+        permitted_by_rails_hosts?(host)
+      end
+
+      # When the application restricts config.hosts, ActionDispatch::HostAuthorization has
+      # already refused every other host; a host it lists is one the developer trusts.
+      def permitted_by_rails_hosts?(host)
+        return false unless defined?(Rails) && Rails.respond_to?(:application) && Rails.application
+        return false unless defined?(ActionDispatch::HostAuthorization::Permissions)
+
+        hosts = Rails.application.config.hosts
+        return false if hosts.nil? || hosts.empty?
+
+        ActionDispatch::HostAuthorization::Permissions.new(hosts).allows?(host)
+      end
+    end
+  end
+end

data/lib/profiler/middleware/cors_middleware.rb

@@ -2,60 +2,62 @@
 
 module Profiler
   module Middleware
+    # Sets the framing headers of every profiler response, and its CORS headers when
+    # extension_cors_enabled is set. Both settings are read on each request.
     class CorsMiddleware
       def initialize(app)
         @app = app
       end
 
       def call(env)
-        # Apply CORS and frame options to all profiler endpoints
-        if env['PATH_INFO'].start_with?('/_profiler/')
-          # Handle OPTIONS preflight request
-          if env['REQUEST_METHOD'] == 'OPTIONS'
-            return [
-              200,
-              cors_headers(env),
-              ['']
-            ]
-          end
-
-          status, headers, body = @app.call(env)
-          headers = headers.dup
-
-          # Add CORS headers
-          cors_headers(env).each do |key, value|
-            headers[key] = value
-          end
-
-          # Allow embedding in iframes from Chrome extensions
-          headers.delete('X-Frame-Options')
-          # Don't set CSP if controller requested to skip it
-          unless env['profiler.skip_csp']
-            # Allow embedding from standard web origins
-            headers['Content-Security-Policy'] = "frame-ancestors 'self' http: https:"
-          end
-
-          [status, headers, body]
-        else
-          @app.call(env)
+        return @app.call(env) unless profiler_path?(env['PATH_INFO'].to_s)
+
+        cors = Profiler.configuration.extension_cors_enabled
+
+        # Handle OPTIONS preflight request
+        if cors && env['REQUEST_METHOD'] == 'OPTIONS'
+          return [200, cors_headers(env), ['']]
         end
+
+        status, headers, body = @app.call(env)
+        headers = headers.dup
+
+        cors_headers(env).each { |key, value| set_header(headers, key, value) } if cors
+
+        # frame-ancestors decides in every browser that knows it, which then ignores
+        # X-Frame-Options; SAMEORIGIN only protects older browsers.
+        set_header(headers, 'X-Frame-Options', 'SAMEORIGIN')
+        set_header(headers, 'Content-Security-Policy', "frame-ancestors #{frame_ancestors}")
+
+        [status, headers, body]
       end
 
       private
 
+      # "/_profiler" itself is the dashboard URL; "/_profilerfoo" belongs to the application.
+      def profiler_path?(path)
+        path == '/_profiler' || path.start_with?('/_profiler/')
+      end
+
+      def frame_ancestors
+        sources = Array(Profiler.configuration.frame_ancestors).map(&:to_s).reject(&:empty?)
+        sources.empty? ? "'none'" : sources.join(' ')
+      end
+
       def cors_headers(env)
-        allowed_origins = Profiler.configuration.cors_allowed_origins
+        allowed_origins = Array(Profiler.configuration.cors_allowed_origins)
         request_origin = env['HTTP_ORIGIN']
 
-        if allowed_origins.include?('*')
-          origin_header = '*'
-        elsif request_origin && allowed_origins.include?(request_origin)
+        if request_origin && allowed_origins.include?(request_origin)
           origin_header = request_origin
+        elsif allowed_origins.include?('*') && !credentialed?(env)
+          # Never on a request carrying credentials: they may be what authorizes it.
+          origin_header = '*'
         end
 
         headers = {
           'Access-Control-Allow-Methods' => 'GET, POST, OPTIONS',
-          'Access-Control-Allow-Headers' => 'Content-Type, X-Requested-With, Accept',
+          'Access-Control-Allow-Headers' => "Content-Type, X-Requested-With, Accept, #{Profiler::FORGERY_PROTECTION_HEADER}",
           'Access-Control-Expose-Headers' => 'X-Profiler-Token'
         }
 
@@ -66,6 +68,16 @@ module Profiler
 
         headers
       end
+
+      def credentialed?(env)
+        !env['HTTP_COOKIE'].to_s.empty? || !env['HTTP_AUTHORIZATION'].to_s.empty?
+      end
+
+      # Replaces a header whatever the case of its existing key, plain Hash or Rack::Headers.
+      def set_header(headers, name, value)
+        headers.keys.each { |key| headers.delete(key) if key.to_s.casecmp?(name) }
+        headers[name] = value
+      end
     end
   end
 end

data/lib/profiler/railtie.rb

@@ -24,11 +24,10 @@ module Profiler
       if Profiler.configuration.enabled
         require_relative "middleware/profiler_middleware"
 
-        # Insert CORS middleware first if enabled
-        if Profiler.configuration.extension_cors_enabled
-          require_relative "middleware/cors_middleware"
-          app.middleware.insert_before 0, Profiler::Middleware::CorsMiddleware
-        end
+        # Always inserted: it sets the framing headers of every profiler response, and its
+        # CORS headers only when extension_cors_enabled is set.
+        require_relative "middleware/cors_middleware"
+        app.middleware.insert_before 0, Profiler::Middleware::CorsMiddleware
 
         app.middleware.insert_before 0, Profiler::Middleware::ProfilerMiddleware
       end

data/lib/profiler/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Profiler
-  VERSION = "0.30.5"
+  VERSION = "0.30.6"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rails-profiler
 version: !ruby/object:Gem::Version
-  version: 0.30.5
+  version: 0.30.6
 platform: ruby
 authors:
 - Sébastien Duplessy
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-03 00:00:00.000000000 Z
+date: 2026-10-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -168,6 +168,7 @@ files:
 - lib/profiler/instrumentation/sidekiq_middleware.rb
 - lib/profiler/instrumentation/thread_context_propagation.rb
 - lib/profiler/job_profiler.rb
+- lib/profiler/local_request.rb
 - lib/profiler/mcp/body_formatter.rb
 - lib/profiler/mcp/file_cache.rb
 - lib/profiler/mcp/path_extractor.rb