secure_headers 0.4.0 → 0.5.0

data/HISTORY.md

@@ -1,10 +1,33 @@
+0.5.0
+======
+
+X-Content-Type-Options also applied to Chrome requests
+
+0.4.3
+======
+
+Safari 5 is just completely broken when CSP is used, both mobile and desktop versions
+
+0.4.2
+======
+
+- Stupid bug where Fixnums couldn't be used for config values
+- Doc updates
+
+0.4.1
+======
+
+- Allow strings or ints in the HSTS max-age (@reedloden)
+
 0.4.0
 =======
+
 - Treat each header as it's own before_filter. This allows you to `skip_before_filter :set_X_header, :only => :bad_idea
 - Should be backwards compatible, but it is a change to the API.
 
 0.3.0
 =======
+
 - Greatly reduce the need to use the forward_endpoint attribute. If you are posting from your site to a host that matches TLD+1 (e.g. translate.twitter.com matches twitter.com), use a protocol relative value for report-uri. This will alleviate the need to use forwarding. If your host doesn't match, you still need to use forwarding due to host mismatches for Firefox.
 
 0.2.3

data/README.md

@@ -3,7 +3,7 @@
 The gem will automatically apply several headers that are related to security.  This includes:
 - Content Security Policy (CSP) - Helps detect/prevent XSS, mixed-content, and other classes of attack.  [CSP 1.1 Specification](https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html)
 - HTTP Strict Transport Security (HSTS) - Ensures the browser never visits the http version of a website. Protects from SSLStrip/Firesheep attacks.  [HSTS Specification](https://tools.ietf.org/html/rfc6797)
-- X-Frame-Options (XFO) - Prevents your content from being framed and potentially clickjacked. [X-Frame-Options draft](https://tools.ietf.org/html/draft-ietf-websec-x-frame-options-00)
+- X-Frame-Options (XFO) - Prevents your content from being framed and potentially clickjacked. [X-Frame-Options draft](https://tools.ietf.org/html/draft-ietf-websec-x-frame-options-02)
 - X-XSS-Protection - [Cross site scripting heuristic filter for IE/Chrome](http://msdn.microsoft.com/en-us/library/dd565647\(v=vs.85\).aspx)
 - X-Content-Type-Options - [Prevent content type sniffing](http://msdn.microsoft.com/en-us/library/ie/gg622941\(v=vs.85\).aspx)
 
@@ -41,7 +41,7 @@ By default, it will set all of the headers listed in the options section below u
 
 Use the standard `skip_before_filter :filter_name, options` mechanism. e.g. `skip_before_filter :set_csp_header, :only => :tinymce_page`
 
-The following methods are going to be called, unles they are provided in a `skip_before_filter` block.
+The following methods are going to be called, unless they are provided in a `skip_before_filter` block.
 
 * `:set_csp_header`
 * `:set_hsts_header`
@@ -53,10 +53,10 @@ The following methods are going to be called, unles they are provided in a `skip
 
 This gem makes a few assumptions about how you will use some features.  For example:
 
-* It adds 'chrome-extension:' to your CSP directives by default.  This helps drastically reduce the amount of reports, but you can also disable this feature by supplying :disable_chrome_extension => true.
-* It fills any blank directives with the value in :default_src  Getting a default\-src report is pretty useless.  This way, you will always know what type of violation occurred. You can disable this feature by supplying :disable_fill_missing => true.
+* It adds 'chrome-extension:' to your CSP directives by default.  This helps drastically reduce the amount of reports, but you can also disable this feature by supplying `:disable_chrome_extension => true`.
+* It fills any blank directives with the value in `:default_src`  Getting a default\-src report is pretty useless.  This way, you will always know what type of violation occurred. You can disable this feature by supplying `:disable_fill_missing => true`.
 * It copies the connect\-src value to xhr\-src for AJAX requests when using Firefox.
-* Firefox does not support cross\-origin CSP reports.  If we are using Firefox, AND the value for :report_uri does not satisfy the same\-origin requirements, we will instead forward to an internal endpoint (`FF_CSP_ENDPOINT`).  This is also the case if :report_uri only contains a path, which we assume will be cross host. This endpoint will in turn forward the request to the value in :forward_endpoint without restriction. More information can be found in the "Note on Firefox handling of CSP" section.
+* Firefox does not support cross\-origin CSP reports.  If we are using Firefox, AND the value for `:report_uri` does not satisfy the same\-origin requirements, we will instead forward to an internal endpoint (`FF_CSP_ENDPOINT`).  This is also the case if `:report_uri` only contains a path, which we assume will be cross host. This endpoint will in turn forward the request to the value in `:forward_endpoint` without restriction. More information can be found in the "Note on Firefox handling of CSP" section.
 
 
 ## Configuration
@@ -77,7 +77,7 @@ This gem makes a few assumptions about how you will use some features.  For exam
   }
 end
 
-# and then simply include
+# and then simply include this in application_controller
 ensure_security_headers
 ```
 
@@ -101,7 +101,7 @@ header will be constructed using the supplied options.
 ### Widely supported
 
 ```ruby
-:hsts             => {:max_age => 631138519, :include_subdomain => true}
+:hsts             => {:max_age => 631138519, :include_subdomains => true}
 :x_frame_options  => {:value => 'SAMEORIGIN'}
 :x_xss_protection => {:value => 1, :mode => false}  # set the :mode option to 'block' to enforce the browser's xss filter
 ```
@@ -159,6 +159,16 @@ and [Mozilla CSP specification](https://wiki.mozilla.org/Security/CSP/Specificat
       :img_src => 'http://mycdn.example.com'
     }
   }
+  
+  # script-nonce is an experimental feature of CSP 1.1 available in Chrome. It allows
+  # you to whitelist inline script blocks. For more information, see
+  # https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html#script-nonce
+  :script_nonce => { 'abc123' }
+  
+  # you can also use lambdas to use dynamically generated nonces
+  :script_nonce => lambda { @script_nonce] = 'something' } 
+  # which can be used to whitelist a script block:
+  # script_tag :nonce = @script_nonce { inline_script_call() }
 }
 ```
 

data/fixtures/rails_3_2_12/config/initializers/secure_headers.rb

@@ -2,7 +2,7 @@
   config.hsts = { :max_age => 10.years.to_i.to_s, :include_subdomains => false }
   config.x_frame_options = 'SAMEORIGIN'
   config.x_content_type_options = "nosniff"
-  config.x_xss_protection = {:value => 1, :mode => 'BLOCK'}
+  config.x_xss_protection = {:value => 1, :mode => 'block'}
   csp = {
     :default_src => "self",
     :disable_chrome_extension => true,
@@ -12,4 +12,4 @@
   }
 
   config.csp = csp
-end
+end

data/fixtures/rails_3_2_12/spec/controllers/other_things_controller_spec.rb

@@ -7,14 +7,14 @@ describe OtherThingsController do
       request.env['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5'
     end
 
-    it "sets the X-XSS-PROTECTION header" do
+    it "sets the X-XSS-Protection header" do
       get :index
-      response.headers['X-XSS-Protection'].should == '1; mode=BLOCK'
+      response.headers['X-XSS-Protection'].should == '1; mode=block'
     end
 
-    it "sets the X-FRAME-OPTIONS header" do
+    it "sets the X-Frame-Options header" do
       get :index
-      response.headers['X-FRAME-OPTIONS'].should == 'SAMEORIGIN'
+      response.headers['X-Frame-Options'].should == 'SAMEORIGIN'
     end
 
     it "sets the X-WebKit-CSP header" do
@@ -23,14 +23,19 @@ describe OtherThingsController do
     end
 
     #mock ssl
-    it "sets the STRICT-TRANSPORT-SECURITY header" do
+    it "sets the Strict-Transport-Security header" do
       request.env['HTTPS'] = 'on'
       get :index
       response.headers['Strict-Transport-Security'].should == "max-age=315576000"
     end
 
+    it "sets the X-Content-Type-Options header" do
+      get :index
+      response.headers['X-Content-Type-Options'].should == "nosniff"
+    end
+
     context "using IE" do
-      it "sets the X-CONTENT-TYPE-OPTIONS header" do
+      it "sets the X-Content-Type-Options header" do
         request.env['HTTP_USER_AGENT'] = "Mozilla/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident/5.0; InfoPath.2; SLCC1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727) 3gpp-gba UNTRUSTED/1.0"
         get :index
         response.headers['X-Content-Type-Options'].should == "nosniff"

data/fixtures/rails_3_2_12/spec/controllers/things_controller_spec.rb

@@ -11,14 +11,14 @@ describe ThingsController do
         request.env['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5'
     end
 
-    it "sets the X-XSS-PROTECTION header" do
+    it "sets the X-XSS-Protection header" do
       get :index
-      response.headers['X-XSS-Protection'].should == '1; mode=BLOCK'
+      response.headers['X-XSS-Protection'].should == '1; mode=block'
     end
 
-    it "sets the X-FRAME-OPTIONS header" do
+    it "sets the X-Frame-Options header" do
       get :index
-      response.headers['X-FRAME-OPTIONS'].should == 'SAMEORIGIN'
+      response.headers['X-Frame-Options'].should == 'SAMEORIGIN'
     end
 
     it "sets the X-WebKit-CSP header" do
@@ -27,14 +27,19 @@ describe ThingsController do
     end
 
     #mock ssl
-    it "sets the STRICT-TRANSPORT-SECURITY header" do
+    it "sets the Strict-Transport-Security header" do
       request.env['HTTPS'] = 'on'
       get :index
       response.headers['Strict-Transport-Security'].should == "max-age=315576000"
     end
 
+    it "sets the X-Content-Type-Options header" do
+      get :index
+      response.headers['X-Content-Type-Options'].should == "nosniff"
+    end
+
     context "using IE" do
-      it "sets the X-CONTENT-TYPE-OPTIONS header" do
+      it "sets the X-Content-Type-Options header" do
         request.env['HTTP_USER_AGENT'] = "Mozilla/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident/5.0; InfoPath.2; SLCC1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727) 3gpp-gba UNTRUSTED/1.0"
         get :index
         response.headers['X-Content-Type-Options'].should == "nosniff"
@@ -44,4 +49,4 @@ describe ThingsController do
 end
 
 
-# response.headers['X-WebKit-CSP-Report-Only'].should == "default-src 'self'; report-uri somewhere"
+# response.headers['X-WebKit-CSP-Report-Only'].should == "default-src 'self'; report-uri somewhere"

data/fixtures/rails_3_2_12_no_init/spec/controllers/other_things_controller_spec.rb

@@ -7,14 +7,14 @@ describe OtherThingsController do
       request.env['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5'
     end
 
-    it "sets the X-XSS-PROTECTION header" do
+    it "sets the X-XSS-Protection header" do
       get :index
       response.headers['X-XSS-Protection'].should == SecureHeaders::XXssProtection::Constants::DEFAULT_VALUE
     end
 
-    it "sets the X-FRAME-OPTIONS header" do
+    it "sets the X-Frame-Options header" do
       get :index
-      response.headers['X-FRAME-OPTIONS'].should == SecureHeaders::XFrameOptions::Constants::DEFAULT_VALUE
+      response.headers['X-Frame-Options'].should == SecureHeaders::XFrameOptions::Constants::DEFAULT_VALUE
     end
 
     it "sets the X-WebKit-CSP header" do
@@ -23,17 +23,22 @@ describe OtherThingsController do
     end
 
     #mock ssl
-    it "sets the STRICT-TRANSPORT-SECURITY header" do
+    it "sets the Strict-Transport-Security header" do
       request.env['HTTPS'] = 'on'
       get :index
       response.headers['Strict-Transport-Security'].should == SecureHeaders::StrictTransportSecurity::Constants::DEFAULT_VALUE
     end
 
+    it "sets the X-Content-Type-Options header" do
+      get :index
+      response.headers['X-Content-Type-Options'].should == SecureHeaders::XContentTypeOptions::Constants::DEFAULT_VALUE
+    end
+
     context "using IE" do
-      it "sets the X-CONTENT-TYPE-OPTIONS header" do
+      it "sets the X-Content-Type-Options header" do
         request.env['HTTP_USER_AGENT'] = "Mozilla/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident/5.0; InfoPath.2; SLCC1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727) 3gpp-gba UNTRUSTED/1.0"
         get :index
-        response.headers['X-Content-Type-Options'].should == "nosniff"
+        response.headers['X-Content-Type-Options'].should == SecureHeaders::XContentTypeOptions::Constants::DEFAULT_VALUE
       end
     end
   end

data/fixtures/rails_3_2_12_no_init/spec/controllers/things_controller_spec.rb

@@ -11,14 +11,14 @@ describe ThingsController do
         request.env['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5'
     end
 
-    it "sets the X-XSS-PROTECTION header" do
+    it "sets the X-XSS-Protection header" do
       get :index
       response.headers['X-XSS-Protection'].should == SecureHeaders::XXssProtection::Constants::DEFAULT_VALUE
     end
 
-    it "sets the X-FRAME-OPTIONS header" do
+    it "sets the X-Frame-Options header" do
       get :index
-      response.headers['X-FRAME-OPTIONS'].should == SecureHeaders::XFrameOptions::Constants::DEFAULT_VALUE
+      response.headers['X-Frame-Options'].should == SecureHeaders::XFrameOptions::Constants::DEFAULT_VALUE
     end
 
     it "sets the X-WebKit-CSP header" do
@@ -27,17 +27,22 @@ describe ThingsController do
     end
 
     #mock ssl
-    it "sets the STRICT-TRANSPORT-SECURITY header" do
+    it "sets the Strict-Transport-Security header" do
       request.env['HTTPS'] = 'on'
       get :index
       response.headers['Strict-Transport-Security'].should == SecureHeaders::StrictTransportSecurity::Constants::DEFAULT_VALUE
     end
 
+    it "sets the X-Content-Type-Options header" do
+      get :index
+      response.headers['X-Content-Type-Options'].should == SecureHeaders::XContentTypeOptions::Constants::DEFAULT_VALUE
+    end
+
     context "using IE" do
-      it "sets the X-CONTENT-TYPE-OPTIONS header" do
+      it "sets the X-Content-Type-Options header" do
         request.env['HTTP_USER_AGENT'] = "Mozilla/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident/5.0; InfoPath.2; SLCC1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727) 3gpp-gba UNTRUSTED/1.0"
         get :index
-        response.headers['X-Content-Type-Options'].should == "nosniff"
+        response.headers['X-Content-Type-Options'].should == SecureHeaders::XContentTypeOptions::Constants::DEFAULT_VALUE
       end
     end
   end

data/lib/secure_headers/headers/content_security_policy.rb

@@ -36,6 +36,7 @@ module SecureHeaders
     # :report used to determine what :ssl_request, :ua, and :request_uri are set to
     def initialize(config=nil, options={})
       @experimental = !!options.delete(:experimental)
+      @controller = options.delete(:controller)
       if options[:request]
         parse_request(options[:request])
       else
@@ -65,6 +66,7 @@ module SecureHeaders
       end
 
       @report_uri = @config.delete(:report_uri)
+      @script_nonce = @config.delete(:script_nonce)
 
       normalize_csp_options
       normalize_reporting_endpoint
@@ -103,7 +105,8 @@ module SecureHeaders
       header_value = [
         build_impl_specific_directives,
         generic_directives(@config),
-        report_uri_directive
+        report_uri_directive,
+        script_nonce_directive,
       ].join
 
       #store the value for next time
@@ -208,6 +211,18 @@ module SecureHeaders
       "report-uri #{@report_uri};"
     end
 
+    def script_nonce_directive
+      return '' if @script_nonce.nil?
+      nonce_value = if @script_nonce.is_a?(String)
+                      @script_nonce
+                    elsif @controller
+                      @controller.instance_exec(&@script_nonce)
+                    else
+                      @script_nonce.call
+                    end
+      "script-nonce #{nonce_value};"
+    end
+
     def generic_directives(config)
       header_value = ''
       if config[:img_src]

data/lib/secure_headers/headers/strict_transport_security.rb

@@ -29,7 +29,7 @@ module SecureHeaders
       end
 
       max_age = @config.fetch(:max_age, HSTS_MAX_AGE)
-      value = "max-age=" + max_age
+      value = "max-age=" + max_age.to_s
       value += "; includeSubdomains" if @config[:include_subdomains]
 
       value
@@ -41,7 +41,7 @@ module SecureHeaders
       if @config.is_a? Hash
         if !@config[:max_age]
           raise STSBuildError.new("No max-age was supplied.")
-        elsif @config[:max_age] !~ /\A\d+\z/
+        elsif @config[:max_age].to_s !~ /\A\d+\z/
           raise STSBuildError.new("max-age must be a number. #{@config[:max_age]} was supplied.")
         end
       else

data/lib/secure_headers/headers/x_frame_options.rb

@@ -2,9 +2,9 @@ module SecureHeaders
   class XFOBuildError < StandardError; end
   class XFrameOptions
     module Constants
-      XFO_HEADER_NAME = "X-FRAME-OPTIONS"
+      XFO_HEADER_NAME = "X-Frame-Options"
       DEFAULT_VALUE = 'SAMEORIGIN'
-      VALID_XFO_HEADER = /\A(SAMEORIGIN\z|DENY\z|ALLOW-FROM:)/i
+      VALID_XFO_HEADER = /\A(SAMEORIGIN\z|DENY\z|ALLOW-FROM[:\s])/i
     end
     include Constants
 
@@ -37,4 +37,4 @@ module SecureHeaders
       end
     end
   end
-end
+end

data/lib/secure_headers/headers/x_xss_protection.rb

@@ -1,6 +1,5 @@
 module SecureHeaders
   class XXssProtectionBuildError < StandardError; end
-  # IE only
   class XXssProtection
     module Constants
       X_XSS_PROTECTION_HEADER_NAME = 'X-XSS-Protection'
@@ -51,4 +50,4 @@ module SecureHeaders
       end
     end
   end
-end
+end

data/lib/secure_headers/version.rb

@@ -1,3 +1,3 @@
 module SecureHeaders
-  VERSION = "0.4.0"
+  VERSION = "0.5.0"
 end

data/lib/secure_headers.rb

@@ -72,10 +72,10 @@ module SecureHeaders
       options = self.class.options_for :csp, options
       return if options == false
 
-      header = ContentSecurityPolicy.new(options, :request => request)
+      header = ContentSecurityPolicy.new(options, :request => request, :controller => self)
       set_header(header.name, header.value)
       if options && options[:experimental] && options[:enforce]
-        header = ContentSecurityPolicy.new(options, :experimental => true, :request => request)
+        header = ContentSecurityPolicy.new(options, :experimental => true, :request => request, :controller => self)
         set_header(header.name, header.value)
       end
     end
@@ -85,7 +85,7 @@ module SecureHeaders
     end
 
     def set_x_content_type_options_header(options=self.class.secure_headers_options[:x_content_type_options])
-      return unless brwsr.ie?
+      return unless brwsr.ie? || brwsr.chrome?
       set_a_header(:x_content_type_options, XContentTypeOptions, options)
     end
 
@@ -113,8 +113,7 @@ module SecureHeaders
     end
 
     def broken_implementation?(browser)
-      #IOS 5 sometimes refuses to load external resources even when whitelisted with CSP
-      return browser.ios5?
+      return browser.ios5? || (browser.safari? && browser.version == 5)
     end
   end
 end

data/spec/lib/secure_headers/headers/content_security_policy_spec.rb

@@ -397,6 +397,38 @@ module SecureHeaders
           end
         end
       end
+
+      context "when supplying a script nonce callback" do
+        let(:options) {
+          default_opts.merge({
+            :script_nonce => "random",
+          })
+        }
+
+        it "uses the value in the X-Webkit-CSP" do
+          csp = ContentSecurityPolicy.new(options, :request => request_for(CHROME))
+          csp.value.should match "script-nonce random;"
+        end
+
+        it "uses the value in the X-Content-Security-Policy" do
+          csp = ContentSecurityPolicy.new(options, :request => request_for(FIREFOX))
+          csp.value.should match "script-nonce random;"
+        end
+
+        it "runs a dynamic nonce generator" do
+          options[:script_nonce] = lambda { 'something' }
+          csp = ContentSecurityPolicy.new(options, :request => request_for(CHROME))
+          csp.value.should match "script-nonce something;"
+        end
+
+        it "runs against the given controller context" do
+          fake_params = {}
+          options[:script_nonce] = lambda { params[:script_nonce] = 'something' }
+          csp = ContentSecurityPolicy.new(options, :request => request_for(CHROME), :controller => double(:params => fake_params))
+          csp.value.should match "script-nonce something;"
+          fake_params.should == {:script_nonce => 'something'}
+        end
+      end
     end
   end
 end

data/spec/lib/secure_headers/headers/strict_transport_security_spec.rb

@@ -5,29 +5,26 @@ module SecureHeaders
     specify{ StrictTransportSecurity.new.name.should == "Strict-Transport-Security" }
 
     describe "#value" do
-      it "sets Strict Transport Security headers" do
-        s = StrictTransportSecurity.new
-        s.value.should == StrictTransportSecurity::Constants::DEFAULT_VALUE
-      end
-
-      it "allows you to specify includeSubdomains" do
-        s = StrictTransportSecurity.new(:max_age => HSTS_MAX_AGE, :include_subdomains => true)
-        s.value.should == "max-age=#{HSTS_MAX_AGE}; includeSubdomains"
-      end
-
-      it "accepts a string value and returns verbatim" do
-        s = StrictTransportSecurity.new('max-age=1234')
-        s.value.should == "max-age=1234"
-      end
-
-      it "allows you to specify max-age" do
-        age = '8675309'
-        s = StrictTransportSecurity.new(:max_age => age)
-        s.value.should == "max-age=#{age}"
-      end
+      specify { StrictTransportSecurity.new.value.should == StrictTransportSecurity::Constants::DEFAULT_VALUE}
+      specify { StrictTransportSecurity.new("max-age=1234").value.should == "max-age=1234"}
+      specify { StrictTransportSecurity.new(:max_age => '1234').value.should == "max-age=1234"}
+      specify { StrictTransportSecurity.new(:max_age => 1234).value.should == "max-age=1234"}
+      specify { StrictTransportSecurity.new(:max_age => HSTS_MAX_AGE, :include_subdomains => true).value.should == "max-age=#{HSTS_MAX_AGE}; includeSubdomains"}
 
       context "with an invalid configuration" do
         context "with a hash argument" do
+          it "should allow string values for max-age" do
+            lambda {
+              StrictTransportSecurity.new(:max_age => '1234')
+            }.should_not raise_error
+          end
+
+          it "should allow integer values for max-age" do
+            lambda {
+              StrictTransportSecurity.new(:max_age => 1234)
+            }.should_not raise_error
+          end
+
           it "raises an exception with an invalid max-age" do
             lambda {
               StrictTransportSecurity.new(:max_age => 'abc123')

data/spec/lib/secure_headers/headers/x_frame_options_spec.rb

@@ -2,7 +2,7 @@ require 'spec_helper'
 
 module SecureHeaders
   describe XFrameOptions do
-    specify{ XFrameOptions.new.name.should == "X-FRAME-OPTIONS" }
+    specify{ XFrameOptions.new.name.should == "X-Frame-Options" }
 
     describe "#value" do
       specify { XFrameOptions.new.value.should == XFrameOptions::Constants::DEFAULT_VALUE}

data/spec/lib/secure_headers_spec.rb

@@ -24,7 +24,10 @@ describe SecureHeaders do
     :chrome => 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5',
     :ie => 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)',
     :opera => 'Opera/9.80 (Windows NT 6.1; U; es-ES) Presto/2.9.181 Version/12.00',
-    :ios5 => "Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3"
+    :ios5 => "Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3",
+    :ios6 => "Mozilla/5.0 (iPhone; CPU iPhone OS 614 like Mac OS X) AppleWebKit/536.26 (KHTML like Gecko) Version/6.0 Mobile/10B350 Safari/8536.25",
+    :safari5 => "Mozilla/5.0 (iPad; CPU OS 5_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko ) Version/5.1 Mobile/9B176 Safari/7534.48.3",
+    :safari6 => "Mozilla/5.0 (Macintosh; Intel Mac OS X 1084) AppleWebKit/536.30.1 (KHTML like Gecko) Version/6.0.5 Safari/536.30.1"
   }
 
   def should_assign_header name, value
@@ -77,12 +80,10 @@ describe SecureHeaders do
       it "sets all default headers for #{name} (smoke test)" do
         stub_user_agent(useragent)
         number_of_headers = case name
-        when :ie
+        when :ie, :chrome
           5
-        when :opera
-          4
-        when :ios5
-          3 # csp is disabled for ios5
+        when :ios5, :safari5
+          3 # csp breaks these browsers
         else
           4
         end
@@ -96,29 +97,28 @@ describe SecureHeaders do
       end
     end
 
-    it "does not set the X-Content-Type-Options when disabled" do
+    it "does not set the X-Content-Type-Options header if disabled" do
       stub_user_agent(USER_AGENTS[:ie])
       should_not_assign_header(X_CONTENT_TYPE_OPTIONS_HEADER_NAME)
       subject.set_x_content_type_options_header(false)
     end
 
-    it "does not set the X-XSS-PROTECTION when disabled" do
-      stub_user_agent(USER_AGENTS[:ie])
+    it "does not set the X-XSS-Protection header if disabled" do
       should_not_assign_header(X_XSS_PROTECTION_HEADER_NAME)
       subject.set_x_xss_protection_header(false)
     end
 
-    it "does not set the X-FRAME-OPTIONS header if disabled" do
+    it "does not set the X-Frame-Options header if disabled" do
       should_not_assign_header(XFO_HEADER_NAME)
       subject.set_x_frame_options_header(false)
     end
 
-    it "does not set the hsts header if disabled" do
+    it "does not set the HSTS header if disabled" do
       should_not_assign_header(HSTS_HEADER_NAME)
       subject.set_hsts_header(false)
     end
 
-    it "does not set the hsts header the request is over HTTP" do
+    it "does not set the HSTS header if request is over HTTP" do
       subject.stub_chain(:request, :ssl?).and_return(false)
       should_not_assign_header(HSTS_HEADER_NAME)
       subject.set_hsts_header({:include_subdomains => true})
@@ -139,7 +139,7 @@ describe SecureHeaders do
     end
 
     context "when disabled by configuration settings" do
-      it "does not set the X-Content-Type-Options when disabled" do
+      it "does not set any headers when disabled" do
         ::SecureHeaders::Configuration.configure do |config|
           config.hsts = false
           config.x_frame_options = false
@@ -155,48 +155,67 @@ describe SecureHeaders do
   end
 
   describe "#set_x_frame_options_header" do
-    it "sets the X-FRAME-OPTIONS header" do
+    it "sets the X-Frame-Options header" do
       should_assign_header(XFO_HEADER_NAME, SecureHeaders::XFrameOptions::Constants::DEFAULT_VALUE)
       subject.set_x_frame_options_header
     end
 
-    it "allows a custom X-FRAME-OPTIONS header" do
+    it "allows a custom X-Frame-Options header" do
       should_assign_header(XFO_HEADER_NAME, "DENY")
       subject.set_x_frame_options_header(:value => 'DENY')
     end
   end
 
-  context "when using IE" do
-    before(:each) do
-      stub_user_agent(USER_AGENTS[:ie])
+  describe "#set_strict_transport_security" do
+    it "sets the Strict-Transport-Security header" do
+      should_assign_header(HSTS_HEADER_NAME, SecureHeaders::StrictTransportSecurity::Constants::DEFAULT_VALUE)
+      subject.set_hsts_header
     end
 
-    describe "#set_x_xss_protection" do
-      it "sets the XSS protection header" do
-        should_assign_header(X_XSS_PROTECTION_HEADER_NAME, '1')
-        subject.set_x_xss_protection_header
-      end
+    it "allows you to specific a custom max-age value" do
+      should_assign_header(HSTS_HEADER_NAME, 'max-age=1234')
+      subject.set_hsts_header(:max_age => 1234)
+    end
 
-      it "sets a custom X-XSS-PROTECTION header" do
-        should_assign_header(X_XSS_PROTECTION_HEADER_NAME, '0')
-        subject.set_x_xss_protection_header("0")
-      end
+    it "allows you to specify includeSubdomains" do
+      should_assign_header(HSTS_HEADER_NAME, "max-age=#{HSTS_MAX_AGE}; includeSubdomains")
+      subject.set_hsts_header(:max_age => HSTS_MAX_AGE, :include_subdomains => true)
+    end
+  end
 
-      it "sets the block flag" do
-        should_assign_header(X_XSS_PROTECTION_HEADER_NAME, '1; mode=block')
-        subject.set_x_xss_protection_header(:mode => 'block', :value => 1)
-      end
+  describe "#set_x_xss_protection" do
+    it "sets the X-XSS-Protection header" do
+      should_assign_header(X_XSS_PROTECTION_HEADER_NAME, SecureHeaders::XXssProtection::Constants::DEFAULT_VALUE)
+      subject.set_x_xss_protection_header
     end
 
-    describe "#set_x_content_type_options" do
-      it "sets the X-Content-Type-Options" do
-        should_assign_header(X_CONTENT_TYPE_OPTIONS_HEADER_NAME, 'nosniff')
-        subject.set_x_content_type_options_header
-      end
+    it "sets a custom X-XSS-Protection header" do
+      should_assign_header(X_XSS_PROTECTION_HEADER_NAME, '0')
+      subject.set_x_xss_protection_header("0")
+    end
+
+    it "sets the block flag" do
+      should_assign_header(X_XSS_PROTECTION_HEADER_NAME, '1; mode=block')
+      subject.set_x_xss_protection_header(:mode => 'block', :value => 1)
+    end
+  end
 
-      it "lets you override X-Content-Type-Options" do
-        should_assign_header(X_CONTENT_TYPE_OPTIONS_HEADER_NAME, 'nosniff')
-        subject.set_x_content_type_options_header(:value => 'nosniff')
+  describe "#set_x_content_type_options" do
+    [:ie, :chrome].each do |useragent|
+      context "when using #{useragent}" do
+        before(:each) do
+          stub_user_agent(USER_AGENTS[useragent])
+        end
+
+        it "sets the X-Content-Type-Options header" do
+          should_assign_header(X_CONTENT_TYPE_OPTIONS_HEADER_NAME, SecureHeaders::XContentTypeOptions::Constants::DEFAULT_VALUE)
+          subject.set_x_content_type_options_header
+        end
+
+        it "lets you override X-Content-Type-Options" do
+          should_assign_header(X_CONTENT_TYPE_OPTIONS_HEADER_NAME, 'nosniff')
+          subject.set_x_content_type_options_header(:value => 'nosniff')
+        end
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-04-08 00:00:00.000000000 Z
+date: 2013-05-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: brwsr
@@ -190,7 +190,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 1.8.23
+rubygems_version: 1.8.25
 signing_key: 
 specification_version: 3
 summary: Add easily configured browser headers to responses including content security