secure_headers 2.2.0 → 2.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 8e454769ab715d2e94e5451190e7ef8679810ec0
-  data.tar.gz: 9f0fd48b03bd3e8f5a60b85894492a4a9aee08a0
+  metadata.gz: bdc7e4cc47367102f2318244051b544e4bc5d611
+  data.tar.gz: f4bb9651462b15c056ab9720a0c079283e9c2462
 SHA512:
-  metadata.gz: 9ace533baba91512c2d8b15f12ed188d93feda9b20f7e682caaa740d413b1428e9c39deb2c2fbba4aec6462093f54126de9ca8cc5268d5b8d98851c82876fa6d
-  data.tar.gz: 9b5e12226b456e4983eb31cd75f48ccadf34d80d125ff0fb67ee84afe56f3ca3a682890213e20e2c24e2c715073c0284b4ab8fc3fc86ad722c7ae6d08c0bb207
+  metadata.gz: 888729b84ba1eb266c25c3bbc218c270f9e262bcbf490363a2daad6202803f4ba71a21f59c1a36e816a06c01ab8d28126ba81e05ae4f37ac36a53ee670af8420
+  data.tar.gz: 26640f0a917396faf083eaff557316d4a376e6956ae95915cfb5c815de3269a6ec5cb9a9f6a7684d871d8ff634dc586bb6a6a20dd79ece6cee034d5ec8f20648

data/.ruby-version

@@ -1 +1 @@
-2.1.6
+2.2.3

data/.travis.yml

@@ -1,10 +1,10 @@
 language: ruby
 
 rvm:
+  - "2.2"
   - "2.1"
   - "2.0.0"
   - "1.9.3"
-  - "1.8.7"
   - "jruby-19mode"
 
 sudo: false

data/Gemfile

@@ -3,13 +3,14 @@ source 'https://rubygems.org'
 gemspec
 
 group :test do
-  gem 'rails', '3.2.12'
+  gem 'test-unit', '~> 3.0'
+  gem 'rails', '3.2.22'
   gem 'sqlite3', :platforms => [:ruby, :mswin, :mingw]
   gem 'jdbc-sqlite3', :platforms => [:jruby]
   gem 'rspec-rails', '>= 3.1'
   gem 'rspec', '>= 3.1'
   gem 'growl'
   gem 'rb-fsevent'
-  gem 'coveralls', :platforms => [:ruby_19]
+  gem 'coveralls', :platforms => [:ruby_19, :ruby_20, :ruby_21]
   gem 'i18n', '< 0.7.0', :platforms => [:ruby_18]
 end

data/README.md

@@ -8,7 +8,7 @@ The gem will automatically apply several headers that are related to security.
 - X-Content-Type-Options - [Prevent content type sniffing](http://msdn.microsoft.com/en-us/library/ie/gg622941\(v=vs.85\).aspx)
 - X-Download-Options - [Prevent file downloads opening](http://msdn.microsoft.com/en-us/library/ie/jj542450(v=vs.85).aspx)
 - X-Permitted-Cross-Domain-Policies - [Restrict Adobe Flash Player's access to data](https://www.adobe.com/devnet/adobe-media-server/articles/cross-domain-xml-for-streaming.html)
-- Public Key Pinning - Pin certificate fingerprints in the browser to prevent man-in-the-middle attacks due to compromised Certificate Authorites. [Public Key Pinnning  Specification](https://tools.ietf.org/html/rfc7469)
+- Public Key Pinning - Pin certificate fingerprints in the browser to prevent man-in-the-middle attacks due to compromised Certificate Authorities. [Public Key Pinnning  Specification](https://tools.ietf.org/html/rfc7469)
 
 ## Usage
 
@@ -29,16 +29,12 @@ The following methods are going to be called, unless they are provided in a `ski
 * `:set_x_download_options_header`
 * `:set_x_permitted_cross_domain_policies_header`
 
-### Bonus Features
-
-This gem makes a few assumptions about how you will use some features.  For example:
-
-* It fills any blank directives with the value in `:default_src`  Getting a default\-src report is pretty useless.  This way, you will always know what type of violation occurred. You can disable this feature by supplying `:disable_fill_missing => true`. This is referred to as the "effective-directive" in the spec, but is not well supported as of Nov 5, 2013.
-
 ## Configuration
 
 **Place the following in an initializer (recommended):**
 
+**NOTE: All CSP config values accept procs for one way of dynamically setting values**
+
 ```ruby
 ::SecureHeaders::Configuration.configure do |config|
   config.hsts = {:max_age => 20.years.to_i, :include_subdomains => true}
@@ -48,10 +44,23 @@ This gem makes a few assumptions about how you will use some features.  For exam
   config.x_download_options = 'noopen'
   config.x_permitted_cross_domain_policies = 'none'
   config.csp = {
-    :default_src => "https: self",
-    :enforce => proc {|controller| contoller.current_user.enforce_csp? }
+    :default_src => "https: 'self'",
+    :enforce => proc {|controller| controller.my_feature_flag_api.enabled? },
     :frame_src => "https: http:.twimg.com http://itunes.apple.com",
     :img_src => "https:",
+    :connect_src => "wws:"
+    :font_src => "'self' data:",
+    :frame_src => "'self'",
+    :img_src => "mycdn.com data:",
+    :media_src => "utoob.com",
+    :object_src => "'self'",
+    :script_src => "'self'",
+    :style_src => "'unsafe-inline'",
+    :base_uri => "'self'",
+    :child_src => "'self'",
+    :form_action => "'self' github.com",
+    :frame_ancestors => "'none'",
+    :plugin_types => 'application/x-shockwave-flash',
     :report_uri => '//example.com/uri-directive'
   }
   config.hpkp = {
@@ -81,6 +90,37 @@ ensure_security_headers(
 )
 ```
 
+## Per-action configuration
+
+Sometimes you need to override your content security policy for a given endpoint. Rather than applying the exception globally, you have a few options:
+
+1. Use procs as config values as mentioned above.
+1. Specifying `ensure_security_headers csp: ::SecureHeaders::Configuration.csp.merge(script_src: shadyhost.com)` in a descendent controller will override the settings for that controller only.
+1. Override the `secure_header_options_for` class instance method. e.g.
+
+```ruby
+class SomethingController < ApplicationController 
+  def wumbus
+    # gets style-src override
+  end
+
+  def diffendoofer
+    # does not get style-src override
+  end
+
+  def secure_header_options_for(header, options)
+    options = super
+    if params[:action] == "wumbus"
+      if header == :csp
+        options.merge(style_src: "'self'")
+      end
+    else
+      options
+    end
+  end
+end
+```
+
 ## Options for ensure\_security\_headers
 
 **To disable any of these headers, supply a value of false (e.g. :hsts => false), supplying nil will set the default value**
@@ -142,7 +182,7 @@ This configuration will likely work for most applications without modification.
 ```ruby
 # most basic example
 :csp => {
-  :default_src => "https: inline eval",
+  :default_src => "https: 'unsafe-inline' 'unsafe-eval'",
   :report_uri => '/uri-directive'
 }
 
@@ -158,7 +198,7 @@ This configuration will likely work for most applications without modification.
 
 # Auction site wants to allow images from anywhere, plugin content from a list of trusted media providers (including a content distribution network), and scripts only from its server hosting sanitized JavaScript
 :csp => {
-  :default_src => 'self',
+  :default_src => "'self'",
   :img_src => '*',
   :object_src => ['media1.com', 'media2.com', '*.cdn.com'],
   # alternatively (NOT csv) :object_src => 'media1.com media2.com *.cdn.com'
@@ -197,8 +237,8 @@ Setting a nonce will also set 'unsafe-inline' for browsers that don't support no
 
 ```ruby
 :csp => {
-  :default_src => 'self',
-  :script_src => 'self nonce'
+  :default_src => "'self'",
+  :script_src => "'self' nonce"
 }
 ```
 
@@ -244,7 +284,7 @@ If you only have a few hashes, you can hardcode them for the entire app:
 ```ruby
   config.csp = {
     :default_src => "https:",
-    :script_src => 'self'
+    :script_src => "'self'"
     :script_hashes => ['sha1-abc', 'sha1-qwe']
   }
 ```
@@ -254,7 +294,7 @@ The following will work as well, but may not be as clear:
 ```ruby
   config.csp = {
     :default_src => "https:",
-    :script_src => "self 'sha1-qwe'"
+    :script_src => "'self' 'sha1-qwe'"
   }
 ```
 
@@ -269,7 +309,7 @@ use ::SecureHeaders::ContentSecurityPolicy::ScriptHashMiddleware
 ```ruby
   config.csp = {
     :default_src => "https:",
-    :script_src => 'self',
+    :script_src => "'self'",
     :script_hash_middleware => true
   }
 ```
@@ -415,12 +455,43 @@ def before_load
 end
 ```
 
+### Using in rack middleware
+
+The `SecureHeaders::header_hash` generates a hash of all header values, which is useful for merging with rack middleware values.
+
+```ruby
+class MySecureHeaders
+  include SecureHeaders
+  def initialize(app)
+  @app = app
+ end
+
+ def call(env)
+   status, headers, response = @app.call(env)
+   security_headers = if override?
+     SecureHeaders::header_hash(:csp => false) # uses global config, but overrides CSP config
+   else
+     SecureHeaders::header_hash # uses global config
+   end
+   [status, headers.merge(security_headers), [response.body]]
+ end
+end
+
+module Testapp
+  class Application < Rails::Application
+    config.middleware.use MySecureHeaders
+  end
+end
+```
+
 ## Similar libraries
 
+* Rack [rack-secure_headers](https://github.com/harmoni/rack-secure_headers)
 * Node.js (express) [helmet](https://github.com/evilpacket/helmet) and [hood](https://github.com/seanmonstar/hood)
-* J2EE Servlet >= 3.0 [highlines](https://github.com/sourceclear/headlines)
+* Node.js (hapi) [blankie](https://github.com/nlf/blankie)
+* J2EE Servlet >= 3.0 [headlines](https://github.com/sourceclear/headlines)
 * ASP.NET - [NWebsec](https://github.com/NWebsec/NWebsec/wiki)
-* Python - [django-csp](https://github.com/mozilla/django-csp/) + [commonware](https://github.com/jsocol/commonware/)
+* Python - [django-csp](https://github.com/mozilla/django-csp) + [commonware](https://github.com/jsocol/commonware/); [django-security](https://github.com/sdelements/django-security)
 * Go - [secureheader](https://github.com/kr/secureheader)
 
 ## Authors

data/Rakefile

@@ -15,7 +15,7 @@ task :default => :all_spec
 desc "Run all specs, and test fixture apps"
 task :all_spec => :spec do
   pwd = Dir.pwd
-  Dir.chdir 'fixtures/rails_3_2_12'
+  Dir.chdir 'fixtures/rails_3_2_22'
   puts Dir.pwd
   str = `bundle install >> /dev/null; bundle exec rspec spec`
   puts str
@@ -25,7 +25,7 @@ task :all_spec => :spec do
   end
 
   Dir.chdir pwd
-  Dir.chdir 'fixtures/rails_3_2_12_no_init'
+  Dir.chdir 'fixtures/rails_3_2_22_no_init'
   puts Dir.pwd
   puts `bundle install >> /dev/null; bundle exec rspec spec`
 

data/fixtures/{rails_3_2_12_no_init → rails_3_2_22}/Gemfile

@@ -1,5 +1,6 @@
 source 'https://rubygems.org'
 
-gem 'rails', '3.2.12'
+gem 'test-unit', '~> 3.0'
+gem 'rails', '3.2.22'
 gem 'rspec-rails', '>= 2.0.0'
 gem 'secure_headers', :path => '../..'

data/fixtures/{rails_3_2_12 → rails_3_2_22}/config/initializers/secure_headers.rb

@@ -5,9 +5,8 @@
   config.x_xss_protection = {:value => 1, :mode => 'block'}
   config.x_permitted_cross_domain_policies = 'none'
   csp = {
-    :default_src => "self",
-    :script_src => "self nonce",
-    :disable_fill_missing => true,
+    :default_src => "'self'",
+    :script_src => "'self' nonce",
     :report_uri => 'somewhere',
     :script_hash_middleware => true,
     :enforce => false # false means warnings only

data/fixtures/{rails_3_2_12 → rails_3_2_22}/spec/controllers/other_things_controller_spec.rb

@@ -13,7 +13,7 @@ describe OtherThingsController, :type => :controller do
     options = opts.merge(
       {
         'HTTPS' => 'on',
-        'HTTP_USER_AGENT' => "Mozilla/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident/5.0; InfoPath.2; SLCC1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727) 3gpp-gba UNTRUSTED/1.0"
+        'HTTP_USER_AGENT' => "Mozilla/5.0 (Macintosh; Intel Mac OS X 1084) AppleWebKit/537.22 (KHTML like Gecko) Chrome/25.0.1364.99 Safari/537.22"
       }
     )
 

data/fixtures/{rails_3_2_12 → rails_3_2_22_no_init}/Gemfile

@@ -1,6 +1,6 @@
 source 'https://rubygems.org'
 
-gem 'rails', '3.2.12'
+gem 'test-unit'
+gem 'rails', '3.2.22'
 gem 'rspec-rails', '>= 2.0.0'
 gem 'secure_headers', :path => '../..'
-

data/fixtures/rails_3_2_22_no_init/app/controllers/other_things_controller.rb

@@ -0,0 +1,20 @@
+class OtherThingsController < ApplicationController
+  ensure_security_headers :csp => {:default_src => "'self'"}
+  def index
+
+  end
+
+  def other_action
+    render :text => 'yooooo'
+  end
+
+  def secure_header_options_for(header, options)
+    if params[:action] == "other_action"
+      if header == :csp
+        options.merge(:style_src => "'self'")
+      end
+    else
+      options
+    end
+  end
+end

data/fixtures/{rails_3_2_12_no_init → rails_3_2_22_no_init}/spec/controllers/other_things_controller_spec.rb

@@ -12,11 +12,17 @@ describe OtherThingsController, :type => :controller do
       expect(response.headers['X-Frame-Options']).to eq(SecureHeaders::XFrameOptions::Constants::DEFAULT_VALUE)
     end
 
-    it "sets the X-WebKit-CSP header" do
+    it "sets the CSP header" do
       get :index
       expect(response.headers['Content-Security-Policy-Report-Only']).to eq("default-src 'self'; img-src 'self' data:;")
     end
 
+    it "sets per-action values based on secure_header_options_for" do
+      # munges :style_src => self into policy
+      get :other_action
+      expect(response.headers['Content-Security-Policy-Report-Only']).to eq("default-src 'self'; img-src 'self' data:; style-src 'self';")
+    end
+
     #mock ssl
     it "sets the Strict-Transport-Security header" do
       request.env['HTTPS'] = 'on'

data/fixtures/rails_4_1_8/app/controllers/other_things_controller.rb

@@ -2,4 +2,4 @@ class OtherThingsController < ApplicationController
   def index
 
   end
-end
+end

data/fixtures/rails_4_1_8/config/initializers/secure_headers.rb

@@ -5,9 +5,8 @@
   config.x_xss_protection = {:value => 0}
   config.x_permitted_cross_domain_policies = 'none'
   csp = {
-    :default_src => "self",
-    :script_src => "self nonce",
-    :disable_fill_missing => true,
+    :default_src => "'self'",
+    :script_src => "'self' nonce",
     :report_uri => 'somewhere',
     :script_hash_middleware => true,
     :enforce => false # false means warnings only

data/fixtures/rails_4_1_8/spec/controllers/other_things_controller_spec.rb

@@ -13,7 +13,7 @@ describe OtherThingsController, :type => :controller do
     options = opts.merge(
       {
         'HTTPS' => 'on',
-        'HTTP_USER_AGENT' => "Mozilla/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident/5.0; InfoPath.2; SLCC1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727) 3gpp-gba UNTRUSTED/1.0"
+        'HTTP_USER_AGENT' => "Mozilla/5.0 (Macintosh; Intel Mac OS X 1084) AppleWebKit/537.22 (KHTML like Gecko) Chrome/25.0.1364.99 Safari/537.22"
       }
     )
 

data/lib/secure_headers/headers/content_security_policy.rb

@@ -1,6 +1,8 @@
 require 'uri'
 require 'base64'
 require 'securerandom'
+require 'user_agent_parser'
+require 'json'
 
 module SecureHeaders
   class ContentSecurityPolicyBuildError < StandardError; end
@@ -18,31 +20,25 @@ module SecureHeaders
         :media_src,
         :object_src,
         :script_src,
-        :style_src
-      ]
-
-      NON_DEFAULT_SOURCES = [
+        :style_src,
         :base_uri,
         :child_src,
         :form_action,
         :frame_ancestors,
-        :plugin_types,
-        :referrer,
-        :reflected_xss
+        :plugin_types
       ]
 
       OTHER = [
         :report_uri
       ]
 
-      SOURCE_DIRECTIVES = DIRECTIVES + NON_DEFAULT_SOURCES
-
-      ALL_DIRECTIVES = DIRECTIVES + NON_DEFAULT_SOURCES + OTHER
+      ALL_DIRECTIVES = DIRECTIVES + OTHER
+      CONFIG_KEY = :csp
     end
+
     include Constants
 
-    attr_reader :disable_fill_missing, :ssl_request
-    alias :disable_fill_missing? :disable_fill_missing
+    attr_reader :ssl_request
     alias :ssl_request? :ssl_request
 
     class << self
@@ -108,7 +104,7 @@ module SecureHeaders
       @config = config.inject({}) do |hash, (key, value)|
         config_val = value.respond_to?(:call) ? value.call(@controller) : value
 
-        if SOURCE_DIRECTIVES.include?(key) # directives need to be normalized to arrays of strings
+        if DIRECTIVES.include?(key) # directives need to be normalized to arrays of strings
           config_val = config_val.split if config_val.is_a? String
           if config_val.is_a?(Array)
             config_val = config_val.map do |val|
@@ -124,14 +120,12 @@ module SecureHeaders
       @http_additions = @config.delete(:http_additions)
       @app_name = @config.delete(:app_name)
       @report_uri = @config.delete(:report_uri)
-
-      @disable_fill_missing = !!@config.delete(:disable_fill_missing)
       @enforce = !!@config.delete(:enforce)
+      @disable_img_src_data_uri = !!@config.delete(:disable_img_src_data_uri)
       @tag_report_uri = !!@config.delete(:tag_report_uri)
       @script_hashes = @config.delete(:script_hashes) || []
 
       add_script_hashes if @script_hashes.any?
-      fill_directives unless disable_fill_missing?
     end
 
     ##
@@ -164,6 +158,21 @@ module SecureHeaders
       end
     end
 
+    def to_json
+      build_value
+      @config.to_json.gsub(/(\w+)_src/, "\\1-src")
+    end
+
+    def self.from_json(*json_configs)
+      json_configs.inject({}) do |combined_config, one_config|
+        one_config = one_config.gsub(/(\w+)-src/, "\\1_src")
+        config = JSON.parse(one_config, :symbolize_names => true)
+        combined_config.merge(config) do |_, lhs, rhs|
+          lhs | rhs
+        end
+      end
+    end
+
     private
 
     def add_script_hashes
@@ -175,21 +184,10 @@ module SecureHeaders
       append_http_additions unless ssl_request?
       header_value = [
         generic_directives,
-        non_default_directives,
         report_uri_directive
       ].join.strip
     end
 
-    def fill_directives
-      if default = @config[:default_src]
-        DIRECTIVES.each do |directive|
-          unless @config[directive]
-            @config[directive] = default
-          end
-        end
-      end
-    end
-
     def append_http_additions
       return unless @http_additions
       @http_additions.each do |k, v|
@@ -200,13 +198,18 @@ module SecureHeaders
 
     def translate_dir_value val
       if %w{inline eval}.include?(val)
+        warn "[DEPRECATION] using inline/eval may not be supported in the future. Instead use 'unsafe-inline'/'unsafe-eval' instead."
         val == 'inline' ? "'unsafe-inline'" : "'unsafe-eval'"
-        # self/none are special sources/src-dir-values and need to be quoted
       elsif %{self none}.include?(val)
+        warn "[DEPRECATION] using self/none may not be supported in the future. Instead use 'self'/'none' instead."
         "'#{val}'"
       elsif val == 'nonce'
-        self.class.set_nonce(@controller, nonce)
-        ["'nonce-#{nonce}'", "'unsafe-inline'"]
+        if supports_nonces?(@ua)
+          self.class.set_nonce(@controller, nonce)
+          ["'nonce-#{nonce}'", "'unsafe-inline'"]
+        else
+          "'unsafe-inline'"
+        end
       else
         val
       end
@@ -233,10 +236,11 @@ module SecureHeaders
 
     def generic_directives
       header_value = ''
+      data_uri = @disable_img_src_data_uri ? [] : ["data:"]
       if @config[:img_src]
-        @config[:img_src] = @config[:img_src] + ['data:'] unless @config[:img_src].include?('data:')
+        @config[:img_src] = @config[:img_src] + data_uri unless @config[:img_src].include?('data:')
       else
-        @config[:img_src] = @config[:default_src] + ['data:']
+        @config[:img_src] = @config[:default_src] + data_uri
       end
 
       DIRECTIVES.each do |directive_name|
@@ -246,17 +250,13 @@ module SecureHeaders
       header_value
     end
 
-    def non_default_directives
-      header_value = ''
-      NON_DEFAULT_SOURCES.each do |directive_name|
-        header_value += build_directive(directive_name) if @config[directive_name]
-      end
-
-      header_value
-    end
-
     def build_directive(key)
       "#{self.class.symbol_to_hyphen_case(key)} #{@config[key].join(" ")}; "
     end
+
+    def supports_nonces?(user_agent)
+      parsed_ua = UserAgentParser.parse(user_agent)
+      ["Chrome", "Opera", "Firefox"].include?(parsed_ua.family)
+    end
   end
 end

data/lib/secure_headers/headers/public_key_pins.rb

@@ -6,6 +6,7 @@ module SecureHeaders
       ENV_KEY = 'secure_headers.public_key_pins'
       HASH_ALGORITHMS = [:sha256]
       DIRECTIVES = [:max_age]
+      CONFIG_KEY = :hpkp
     end
     class << self
       def symbol_to_hyphen_case sym

data/lib/secure_headers/headers/strict_transport_security.rb

@@ -8,6 +8,7 @@ module SecureHeaders
       DEFAULT_VALUE = "max-age=" + HSTS_MAX_AGE
       VALID_STS_HEADER = /\Amax-age=\d+(; includeSubdomains)?(; preload)?\z/i
       MESSAGE = "The config value supplied for the HSTS header was invalid."
+      CONFIG_KEY = :hsts
     end
     include Constants
 

data/lib/secure_headers/headers/x_content_type_options.rb

@@ -5,6 +5,7 @@ module SecureHeaders
     module Constants
       X_CONTENT_TYPE_OPTIONS_HEADER_NAME = "X-Content-Type-Options"
       DEFAULT_VALUE = "nosniff"
+      CONFIG_KEY = :x_content_type_options
     end
     include Constants
 
@@ -37,4 +38,4 @@ module SecureHeaders
       end
     end
   end
-end
+end

data/lib/secure_headers/headers/x_download_options.rb

@@ -4,6 +4,7 @@ module SecureHeaders
     module Constants
       XDO_HEADER_NAME = "X-Download-Options"
       DEFAULT_VALUE = 'noopen'
+      CONFIG_KEY = :x_download_options
     end
     include Constants
 

data/lib/secure_headers/headers/x_frame_options.rb

@@ -5,6 +5,7 @@ module SecureHeaders
       XFO_HEADER_NAME = "X-Frame-Options"
       DEFAULT_VALUE = 'SAMEORIGIN'
       VALID_XFO_HEADER = /\A(SAMEORIGIN\z|DENY\z|ALLOW-FROM[:\s])/i
+      CONFIG_KEY = :x_frame_options
     end
     include Constants
 

data/lib/secure_headers/headers/x_permitted_cross_domain_policies.rb

@@ -5,6 +5,7 @@ module SecureHeaders
       XPCDP_HEADER_NAME = "X-Permitted-Cross-Domain-Policies"
       DEFAULT_VALUE = 'none'
       VALID_POLICIES = %w(all none master-only by-content-type by-ftp-filename)
+      CONFIG_KEY = :x_permitted_cross_domain_policies
     end
     include Constants
 

data/lib/secure_headers/headers/x_xss_protection.rb

@@ -5,6 +5,7 @@ module SecureHeaders
       X_XSS_PROTECTION_HEADER_NAME = 'X-XSS-Protection'
       DEFAULT_VALUE = "1"
       VALID_X_XSS_HEADER = /\A[01](; mode=block)?(; report=.*)?\z/i
+      CONFIG_KEY = :x_xss_protection
     end
     include Constants
 

data/lib/secure_headers/version.rb

@@ -1,3 +1,3 @@
 module SecureHeaders
-  VERSION = "2.2.0"
+  VERSION = "2.4.0"
 end