secure_headers 1.1.1 → 1.3.4

checksums.yaml

@@ -0,0 +1,15 @@
+---
+!binary "U0hBMQ==":
+  metadata.gz: !binary |-
+    NzcxMzdhM2IwMTAxN2IyNTc5OTg5OGY1MmJlZGFlNWJmNjBjM2MzMw==
+  data.tar.gz: !binary |-
+    ODNmNjA1YmY1ODEzMWIxYTU2YWYzYmY3NGFjM2Y1ZDU4MDQ0ODkwMQ==
+SHA512:
+  metadata.gz: !binary |-
+    NGEwNTVlZjBmMTcwN2QxYjI5YjVkZGJhZmJiYTJlY2M3YzEyM2JiN2Q3MzY0
+    NzdmNWNhMDIzMmVhNzNkZWRmZTZiYmQ1OWE5MjMwYTY2MDE1NGVhMWU3Mjg4
+    OTdmZTZiOGI0N2NhNGYzZThkMjc3ZWYxMjU5YzhiYTNjNmFmZjE=
+  data.tar.gz: !binary |-
+    MTI1NTNhYzExYjVmYjMwNjNjMGUzMDlmYmVmZTk1YjJiN2UwODM4MzYwNzhj
+    Y2ZhMzYxNTNkM2Y0MWY1YTQ1ZWMyYmQ4NDA3NjJhOGViNTU0MmEwYWY4MTNm
+    MTczMzNjOTliYWYzODFiY2RiNDZmOGQ2ZWU4ZjdiNWJhMTZlMzA=

data/.ruby-gemset

@@ -0,0 +1 @@
+secureheaders

data/.ruby-version

@@ -0,0 +1 @@
+ruby-1.9.3-p484

data/.travis.yml

@@ -1,4 +1,6 @@
 rvm:
+  - "2.1.0"
+  - "2.0.0"
   - "1.9.3"
   - "1.8.7"
 #  - jruby-19mode

data/Gemfile

@@ -7,14 +7,10 @@ group :test do
   gem 'sqlite3', :platform => [:ruby, :mswin, :mingw]
   gem 'jdbc-sqlite3', :platform => :jruby
   gem 'rspec-rails'
-  gem 'spork'
-  gem 'pry'
   gem 'rspec'
-  gem 'guard-spork', :platform => :ruby_19
   gem 'guard-rspec', :platform => :ruby_19
   gem 'growl'
   gem 'rb-fsevent'
-  gem 'simplecov'
   gem 'debugger', :platform => :ruby_19
   gem 'ruby-debug', :platform => :ruby_18
 end

data/Guardfile

@@ -1,8 +1,4 @@
-guard 'spork', :aggressive_kill => false do
-  watch('spec/spec_helper.rb') { :rspec }
-end
-
-guard 'rspec', :cli => "--color --drb --debug", :keep_failed => true, :all_after_pass => true, :focus_on_failed => true do
+guard 'rspec' do
   watch(%r{^spec/.+_spec\.rb$})
   watch(%r{^lib/(.+)\.rb$})     { |m| "spec/lib/#{m[1]}_spec.rb" }
   watch(%r{^app/controllers/(.+)\.rb$})     { |m| "spec/controllers/#{m[1]}_spec.rb" }

data/HISTORY.md

@@ -1,3 +1,50 @@
+1.3.4
+======
+
+* Adds X-Download-Options support
+* Adds support for X-XSS-Protection reporting
+* Defers loading of rails engine for faster boot times
+
+1.3.3
+======
+
+@agl just made a new option for HSTS representing confirmation that a site wants to be included in a browser's preload list (https://hstspreload.appspot.com).
+
+This just adds a new 'preload' option to the HSTS settings to specify that option.
+
+1.3.2
+======
+
+Adds the ability to "tag" requests and a new config value: :app_name
+
+{
+  :tag_report_uri => true,
+  :enforce => true,
+  :app_name => 'twitter',
+  :report_uri => 'csp_reports'
+}
+
+Results in
+report-uri csp_reports?enforce=true&app_name=twitter
+
+
+1.3.1
+======
+
+Bugfix release: same-origin detection would error out when the URL containined invalid values (like |)
+
+1.3.0
+======
+
+- CSP nonce support was added back and is compliant.
+- Bugs:
+-- enforce, disable_fill_missing, and disable_chrome_extension did not accept lambdas for no good reason
+-- IF a default-src was specified, and an img-src was not, and disable_fill_missing was true, the img-src value would be :data
+
+1.2.0
+======
+- Allow procs to be used as config values.
+
 1.1.1
 ======
 

data/README.md

@@ -85,9 +85,10 @@ Or simply add it to application controller
 
 ```ruby
 ensure_security_headers(
-  :hsts => {:include_subdomains, :x_frame_options => false},
+  :hsts => {:include_subdomains => true, :max_age => 20.years.to_i},
   :x_frame_options => 'DENY',
-  :csp => false)
+  :csp => false
+)
 ```
 
 ## Options for ensure\_security\_headers
@@ -162,13 +163,6 @@ and [Mozilla CSP specification](https://wiki.mozilla.org/Security/CSP/Specificat
       :img_src => 'http://mycdn.example.com'
     }
   }
-
-  # script-nonce is an experimental feature of CSP 1.1 available in Chrome. It allows
-  # you to whitelist inline script blocks. For more information, see
-  # https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html#script-nonce
-  :script_nonce => lambda { @script_nonce = SecureRandom.hex }
-  # which can be used to whitelist a script block:
-  # script_tag :nonce = @script_nonce { inline_script_call() }
 }
 ```
 
@@ -203,9 +197,54 @@ and [Mozilla CSP specification](https://wiki.mozilla.org/Security/CSP/Specificat
 "default-src  'self'; img-src *; object-src media1.com media2.com *.cdn.com; script-src trustedscripts.example.com;"
 ```
 
-## Note on Firefox handling of CSP
+### Tagging Requests
+
+It's often valuable to send extra information in the report uri that is not available in the reports themselves. Namely, "was the policy enforced" and "where did the report come from"
+
+```ruby
+{
+  :tag_report_uri => true,
+  :enforce => true,
+  :app_name => 'twitter',
+  :report_uri => 'csp_reports'
+}
+```
+
+Results in
+```
+report-uri csp_reports?enforce=true&app_name=twitter
+```
+
+### CSP Level 2 features
+
+script/style-nonce can be used to whitelist inline content. To do this, add "nonce" to your script/style-src configuration, then set the nonce attributes on the various tags.
+
+*setting a nonce will also set 'unsafe-inline' for browsers that don't support nonces for backwards compatibility. 'unsafe-inline' is ignored if a nonce is present in a directive in compliant browsers.
+
+```ruby
+:csp => {
+  :default_src => 'self',
+  :script_src => 'self nonce'
+}
+```
+
+> content-security-policy: default-src 'self'; script-src 'self' 'nonce-abc123' 'unsafe-inline'
 
-Currently, Firefox does not support the w3c draft standard.  So there are a few steps taken to make the two interchangeable.
+```erb
+<script nonce="<%= @content_security_policy_nonce %>">
+  console.log("whitelisted, will execute")
+</script>
+
+<script nonce="lol">
+  console.log("won't execute, not whitelisted")
+</script>
+
+<script>
+  console.log("won't execute, not whitelisted")
+</script>
+```
+
+## Note on Firefox handling of CSP
 
 * CSP reports will not POST cross\-origin.  This sets up an internal endpoint in the application that will forward the request. Set the `forward_endpoint` value in the CSP section if you need to post cross origin for firefox. The internal endpoint that receives the initial request will forward the request to `forward_endpoint`
 
@@ -274,22 +313,11 @@ In your `Gemfile`:
 then in your `app.rb` file you can:
 
 ```ruby
+require 'secure_headers/padrino'
+
 module Web
   class App < Padrino::Application
-    include SecureHeaders
-
-    ::SecureHeaders::Configuration.configure do |config|
-      config.hsts                   = {:max_age => 99, :include_subdomains => true}
-      config.x_frame_options        = 'DENY'
-      config.x_content_type_options = "nosniff"
-      config.x_xss_protection       = {:value   => '1', :mode => false}
-      config.csp                    = {
-        :default_src => "https://* inline eval",
-        :report_uri => '//example.com/uri-directive',
-        :img_src => "https://* data:",
-        :frame_src => "https://* http://*.twimg.com http://itunes.apple.com"
-      }
-    end
+    register SecureHeaders::Padrino
 
     get '/' do
       set_csp_header
@@ -299,12 +327,31 @@ module Web
 end
 ```
 
+and in `config/boot.rb`:
+
+```ruby
+def before_load
+  ::SecureHeaders::Configuration.configure do |config|
+    config.hsts                   = {:max_age => 99, :include_subdomains => true}
+    config.x_frame_options        = 'DENY'
+    config.x_content_type_options = "nosniff"
+    config.x_xss_protection       = {:value   => '1', :mode => false}
+    config.csp                    = {
+      :default_src => "https://* inline eval",
+      :report_uri => '//example.com/uri-directive',
+      :img_src => "https://* data:",
+      :frame_src => "https://* http://*.twimg.com http://itunes.apple.com"
+    }
+  end
+end
+```
+
 ## Similar libraries
 
 * Node.js (express) [helmet](https://github.com/evilpacket/helmet) and [hood](https://github.com/seanmonstar/hood)
 * J2EE Servlet >= 3.0 [highlines](https://github.com/sourceclear/headlines)
 * ASP.NET - [NWebsec](http://nwebsec.codeplex.com/)
-* Python - [django-csp](https://github.com/mozilla/django-csp/tree/master/csp) + [commonware](https://github.com/jsocol/commonware/tree/master/commonware/request)
+* Python - [django-csp](https://github.com/mozilla/django-csp/) + [commonware](https://github.com/jsocol/commonware/)
 * Go - [secureheader](https://github.com/kr/secureheader)
 
 ## Authors
@@ -321,6 +368,6 @@ end
 
 ## License
 
-Copyright 2013 Twitter, Inc.
+Copyright 2013-2014 Twitter, Inc and other contributors.
 
 Licensed under the Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0

data/fixtures/rails_3_2_12/Gemfile

@@ -1,14 +1,11 @@
 source 'https://rubygems.org'
 
 gem 'rails', '3.2.12'
-gem 'sqlite3'
 gem 'rspec-rails', '>= 2.0.0'
 gem 'secure_headers', :path => '../..'
-gem 'spork'
 gem 'debugger', :platform => :ruby_19
 gem 'ruby-debug', :platform => :ruby_18
 gem 'guard-rspec'
-gem 'guard-spork'
 gem 'rb-fsevent'
 gem 'growl'
 

data/fixtures/rails_3_2_12/app/views/things/index.html.erb

@@ -1,21 +1 @@
-<h1>Listing things</h1>
-
-<table>
-  <tr>
-    <th></th>
-    <th></th>
-    <th></th>
-  </tr>
-
-<% @things.each do |thing| %>
-  <tr>
-    <td><%= link_to 'Show', thing %></td>
-    <td><%= link_to 'Edit', edit_thing_path(thing) %></td>
-    <td><%= link_to 'Destroy', thing, method: :delete, data: { confirm: 'Are you sure?' } %></td>
-  </tr>
-<% end %>
-</table>
-
-<br />
-
-<%= link_to 'New Thing', new_thing_path %>
+things

data/fixtures/rails_3_2_12/config/application.rb

@@ -1,10 +1,10 @@
 require File.expand_path('../boot', __FILE__)
 
 # Pick the frameworks you want:
-require "active_record/railtie"
+# require "active_record/railtie"
 require "action_controller/railtie"
-require "action_mailer/railtie"
-require "active_resource/railtie"
+# require "action_mailer/railtie"
+# require "active_resource/railtie"
 require "sprockets/railtie"
 # require "rails/test_unit/railtie"
 
@@ -57,7 +57,7 @@ module Rails3212
     # This will create an empty whitelist of attributes available for mass-assignment for all models
     # in your app. As such, your models will need to explicitly whitelist or blacklist accessible
     # parameters by using an attr_accessible or attr_protected declaration.
-    config.active_record.whitelist_attributes = true
+    # config.active_record.whitelist_attributes = true
 
     # Enable the asset pipeline
     config.assets.enabled = true

data/fixtures/rails_3_2_12/config/environments/development.rb

@@ -14,7 +14,7 @@ Rails3212::Application.configure do
   config.action_controller.perform_caching = false
 
   # Don't care if the mailer can't send
-  config.action_mailer.raise_delivery_errors = false
+  # config.action_mailer.raise_delivery_errors = false
 
   # Print deprecation notices to the Rails logger
   config.active_support.deprecation = :log
@@ -23,11 +23,11 @@ Rails3212::Application.configure do
   config.action_dispatch.best_standards_support = :builtin
 
   # Raise exception on mass assignment protection for Active Record models
-  config.active_record.mass_assignment_sanitizer = :strict
+  # config.active_record.mass_assignment_sanitizer = :strict
 
   # Log the query plan for queries taking more than this (works
   # with SQLite, MySQL, and PostgreSQL)
-  config.active_record.auto_explain_threshold_in_seconds = 0.5
+  # config.active_record.auto_explain_threshold_in_seconds = 0.5
 
   # Do not compress assets
   config.assets.compress = false

data/fixtures/rails_3_2_12/config/environments/test.rb

@@ -27,10 +27,10 @@ Rails3212::Application.configure do
   # Tell Action Mailer not to deliver emails to the real world.
   # The :test delivery method accumulates sent emails in the
   # ActionMailer::Base.deliveries array.
-  config.action_mailer.delivery_method = :test
+  # config.action_mailer.delivery_method = :test
 
   # Raise exception on mass assignment protection for Active Record models
-  config.active_record.mass_assignment_sanitizer = :strict
+  # config.active_record.mass_assignment_sanitizer = :strict
 
   # Print deprecation notices to the stderr
   config.active_support.deprecation = :stderr

data/fixtures/rails_3_2_12/config/initializers/secure_headers.rb

@@ -5,6 +5,7 @@
   config.x_xss_protection = {:value => 1, :mode => 'block'}
   csp = {
     :default_src => "self",
+    :script_src => "self nonce",
     :disable_chrome_extension => true,
     :disable_fill_missing => true,
     :report_uri => 'somewhere',

data/fixtures/rails_3_2_12/spec/controllers/other_things_controller_spec.rb

@@ -1,44 +1,45 @@
 require 'spec_helper'
 
-describe OtherThingsController do
+describe OtherThingsController, :type => :controller do
   describe "headers" do
-    before(:each) do
-      # Chrome
-      request.env['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5'
-    end
-
     it "sets the X-XSS-Protection header" do
       get :index
-      response.headers['X-XSS-Protection'].should == '1; mode=block'
+      expect(response.headers['X-XSS-Protection']).to eq('1; mode=block')
     end
 
     it "sets the X-Frame-Options header" do
       get :index
-      response.headers['X-Frame-Options'].should == 'SAMEORIGIN'
+      expect(response.headers['X-Frame-Options']).to eq('SAMEORIGIN')
     end
 
-    it "sets the X-WebKit-CSP header" do
+    it "sets the CSP header with a local reference to a nonce" do
       get :index
-      response.headers['Content-Security-Policy-Report-Only'].should == "default-src 'self'; img-src data:; report-uri somewhere;"
+      nonce = controller.instance_exec { @content_security_policy_nonce }
+      expect(nonce).to match /[a-zA-Z0-9\+\/=]{44}/
+      expect(response.headers['Content-Security-Policy-Report-Only']).to match(/default-src 'self'; img-src 'self' data:; script-src 'self' 'nonce-[a-zA-Z0-9\+\/=]{44}' 'unsafe-inline'; report-uri somewhere;/)
     end
 
-    #mock ssl
     it "sets the Strict-Transport-Security header" do
       request.env['HTTPS'] = 'on'
       get :index
-      response.headers['Strict-Transport-Security'].should == "max-age=315576000"
+      expect(response.headers['Strict-Transport-Security']).to eq("max-age=315576000")
+    end
+
+    it "sets the X-Download-Options header" do
+      get :index
+      expect(response.headers['X-Download-Options']).to eq('noopen')
     end
 
     it "sets the X-Content-Type-Options header" do
       get :index
-      response.headers['X-Content-Type-Options'].should == "nosniff"
+      expect(response.headers['X-Content-Type-Options']).to eq("nosniff")
     end
 
     context "using IE" do
       it "sets the X-Content-Type-Options header" do
         request.env['HTTP_USER_AGENT'] = "Mozilla/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident/5.0; InfoPath.2; SLCC1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727) 3gpp-gba UNTRUSTED/1.0"
         get :index
-        response.headers['X-Content-Type-Options'].should == "nosniff"
+        expect(response.headers['X-Content-Type-Options']).to eq("nosniff")
       end
     end
   end

data/fixtures/rails_3_2_12/spec/controllers/things_controller_spec.rb

@@ -4,45 +4,45 @@ require 'spec_helper'
 # all values are defaulted because no initializer is configured, and the values in app controller
 # only provide csp => false
 
-describe ThingsController do
+describe ThingsController, :type => :controller do
   describe "headers" do
-    before(:each) do
-        # Chrome
-        request.env['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5'
-    end
-
     it "sets the X-XSS-Protection header" do
       get :index
-      response.headers['X-XSS-Protection'].should == '1; mode=block'
+      expect(response.headers['X-XSS-Protection']).to eq('1; mode=block')
     end
 
     it "sets the X-Frame-Options header" do
       get :index
-      response.headers['X-Frame-Options'].should == 'SAMEORIGIN'
+      expect(response.headers['X-Frame-Options']).to eq('SAMEORIGIN')
     end
 
     it "sets the X-WebKit-CSP header" do
       get :index
-      response.headers['Content-Security-Policy-Report-Only'].should == nil
+      expect(response.headers['Content-Security-Policy-Report-Only']).to eq(nil)
     end
 
     #mock ssl
     it "sets the Strict-Transport-Security header" do
       request.env['HTTPS'] = 'on'
       get :index
-      response.headers['Strict-Transport-Security'].should == "max-age=315576000"
+      expect(response.headers['Strict-Transport-Security']).to eq("max-age=315576000")
+    end
+
+    it "sets the X-Download-Options header" do
+      get :index
+      expect(response.headers['X-Download-Options']).to eq('noopen')
     end
 
     it "sets the X-Content-Type-Options header" do
       get :index
-      response.headers['X-Content-Type-Options'].should == "nosniff"
+      expect(response.headers['X-Content-Type-Options']).to eq("nosniff")
     end
 
     context "using IE" do
       it "sets the X-Content-Type-Options header" do
         request.env['HTTP_USER_AGENT'] = "Mozilla/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident/5.0; InfoPath.2; SLCC1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727) 3gpp-gba UNTRUSTED/1.0"
         get :index
-        response.headers['X-Content-Type-Options'].should == "nosniff"
+        expect(response.headers['X-Content-Type-Options']).to eq("nosniff")
       end
     end
   end

data/fixtures/rails_3_2_12/spec/spec_helper.rb

@@ -1,5 +1,5 @@
 require 'rubygems'
-require 'spork'
+
 #uncomment the following line to use spork with the debugger
 #require 'spork/ext/ruby-debug'
 
@@ -11,9 +11,5 @@ require 'spork'
   ENV["RAILS_ENV"] ||= 'test'
   require File.expand_path("../../config/environment", __FILE__)
   require 'rspec/rails'
-  require 'rspec/autorun'
 # end
 
-Spork.each_run do
-
-end

data/fixtures/rails_3_2_12_no_init/Gemfile

@@ -1,14 +1,11 @@
 source 'https://rubygems.org'
 
 gem 'rails', '3.2.12'
-gem 'sqlite3'
 gem 'rspec-rails', '>= 2.0.0'
 gem 'secure_headers', :path => '../..'
-gem 'spork'
 gem 'debugger', :platform => :ruby_19
 gem 'ruby-debug', :platform => :ruby_18
 gem 'guard-rspec'
-gem 'guard-spork'
 gem 'rb-fsevent'
 gem 'growl'
 

data/fixtures/rails_3_2_12_no_init/config/application.rb

@@ -1,10 +1,7 @@
 require File.expand_path('../boot', __FILE__)
 
 # Pick the frameworks you want:
-require "active_record/railtie"
 require "action_controller/railtie"
-require "action_mailer/railtie"
-require "active_resource/railtie"
 require "sprockets/railtie"
 # require "rails/test_unit/railtie"
 
@@ -57,7 +54,7 @@ module Rails3212
     # This will create an empty whitelist of attributes available for mass-assignment for all models
     # in your app. As such, your models will need to explicitly whitelist or blacklist accessible
     # parameters by using an attr_accessible or attr_protected declaration.
-    config.active_record.whitelist_attributes = true
+    # config.active_record.whitelist_attributes = true
 
     # Enable the asset pipeline
     config.assets.enabled = true

data/fixtures/rails_3_2_12_no_init/config/environments/development.rb

@@ -14,7 +14,7 @@ Rails3212::Application.configure do
   config.action_controller.perform_caching = false
 
   # Don't care if the mailer can't send
-  config.action_mailer.raise_delivery_errors = false
+  # config.action_mailer.raise_delivery_errors = false
 
   # Print deprecation notices to the Rails logger
   config.active_support.deprecation = :log
@@ -23,11 +23,11 @@ Rails3212::Application.configure do
   config.action_dispatch.best_standards_support = :builtin
 
   # Raise exception on mass assignment protection for Active Record models
-  config.active_record.mass_assignment_sanitizer = :strict
+  # config.active_record.mass_assignment_sanitizer = :strict
 
   # Log the query plan for queries taking more than this (works
   # with SQLite, MySQL, and PostgreSQL)
-  config.active_record.auto_explain_threshold_in_seconds = 0.5
+  # config.active_record.auto_explain_threshold_in_seconds = 0.5
 
   # Do not compress assets
   config.assets.compress = false

data/fixtures/rails_3_2_12_no_init/config/environments/test.rb

@@ -27,10 +27,10 @@ Rails3212::Application.configure do
   # Tell Action Mailer not to deliver emails to the real world.
   # The :test delivery method accumulates sent emails in the
   # ActionMailer::Base.deliveries array.
-  config.action_mailer.delivery_method = :test
+  # config.action_mailer.delivery_method = :test
 
   # Raise exception on mass assignment protection for Active Record models
-  config.active_record.mass_assignment_sanitizer = :strict
+  # config.active_record.mass_assignment_sanitizer = :strict
 
   # Print deprecation notices to the stderr
   config.active_support.deprecation = :stderr

data/fixtures/rails_3_2_12_no_init/spec/controllers/other_things_controller_spec.rb

@@ -1,44 +1,44 @@
 require 'spec_helper'
 
-describe OtherThingsController do
+describe OtherThingsController, :type => :controller do
   describe "headers" do
-    before(:each) do
-      # Chrome
-      request.env['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5'
-    end
-
     it "sets the X-XSS-Protection header" do
       get :index
-      response.headers['X-XSS-Protection'].should == SecureHeaders::XXssProtection::Constants::DEFAULT_VALUE
+      expect(response.headers['X-XSS-Protection']).to eq(SecureHeaders::XXssProtection::Constants::DEFAULT_VALUE)
     end
 
     it "sets the X-Frame-Options header" do
       get :index
-      response.headers['X-Frame-Options'].should == SecureHeaders::XFrameOptions::Constants::DEFAULT_VALUE
+      expect(response.headers['X-Frame-Options']).to eq(SecureHeaders::XFrameOptions::Constants::DEFAULT_VALUE)
     end
 
     it "sets the X-WebKit-CSP header" do
       get :index
-      response.headers['Content-Security-Policy-Report-Only'].should == "default-src 'self'; img-src data:;"
+      expect(response.headers['Content-Security-Policy-Report-Only']).to eq("default-src 'self'; img-src 'self' data:;")
     end
 
     #mock ssl
     it "sets the Strict-Transport-Security header" do
       request.env['HTTPS'] = 'on'
       get :index
-      response.headers['Strict-Transport-Security'].should == SecureHeaders::StrictTransportSecurity::Constants::DEFAULT_VALUE
+      expect(response.headers['Strict-Transport-Security']).to eq(SecureHeaders::StrictTransportSecurity::Constants::DEFAULT_VALUE)
+    end
+
+    it "sets the X-Download-Options header" do
+      get :index
+      expect(response.headers['X-Download-Options']).to eq(SecureHeaders::XDownloadOptions::Constants::DEFAULT_VALUE)
     end
 
     it "sets the X-Content-Type-Options header" do
       get :index
-      response.headers['X-Content-Type-Options'].should == SecureHeaders::XContentTypeOptions::Constants::DEFAULT_VALUE
+      expect(response.headers['X-Content-Type-Options']).to eq(SecureHeaders::XContentTypeOptions::Constants::DEFAULT_VALUE)
     end
 
     context "using IE" do
       it "sets the X-Content-Type-Options header" do
         request.env['HTTP_USER_AGENT'] = "Mozilla/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident/5.0; InfoPath.2; SLCC1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727) 3gpp-gba UNTRUSTED/1.0"
         get :index
-        response.headers['X-Content-Type-Options'].should == SecureHeaders::XContentTypeOptions::Constants::DEFAULT_VALUE
+        expect(response.headers['X-Content-Type-Options']).to eq(SecureHeaders::XContentTypeOptions::Constants::DEFAULT_VALUE)
       end
     end
   end