From 402b64291c7e7f7e706afe0395b4567d89eb5a4a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Javi=20Mart=C3=ADn?= Date: Mon, 15 Apr 2024 00:52:42 +0200 Subject: [PATCH] Use the new default headers The only change between these headers and the ones sent by Rails 7.0 application is that the `"X-Download-Options" => "noopen"` is no longer sent. Only Internet Explorer used that header, and uploading, previewing and downloading attachments still works fine on Internet Explorer 11 after this change. [1] Pull request 43968 in https://github.com/rails/rails --- config/initializers/new_framework_defaults_7_1.rb | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/config/initializers/new_framework_defaults_7_1.rb b/config/initializers/new_framework_defaults_7_1.rb index 9771bd6a8..864c53003 100644 --- a/config/initializers/new_framework_defaults_7_1.rb +++ b/config/initializers/new_framework_defaults_7_1.rb @@ -13,13 +13,13 @@ # Remove the default X-Download-Options headers since it is used only by Internet Explorer. # If you need to support Internet Explorer, add back `"X-Download-Options" => "noopen"`. #++ -# Rails.application.config.action_dispatch.default_headers = { -# "X-Frame-Options" => "SAMEORIGIN", -# "X-XSS-Protection" => "0", -# "X-Content-Type-Options" => "nosniff", -# "X-Permitted-Cross-Domain-Policies" => "none", -# "Referrer-Policy" => "strict-origin-when-cross-origin" -# } +Rails.application.config.action_dispatch.default_headers = { + "X-Frame-Options" => "SAMEORIGIN", + "X-XSS-Protection" => "0", + "X-Content-Type-Options" => "nosniff", + "X-Permitted-Cross-Domain-Policies" => "none", + "Referrer-Policy" => "strict-origin-when-cross-origin" +} ### # Do not treat an `ActionController::Parameters` instance