Merge pull request #1585 from raul/prevent-clickjacking

Require `X-Frame-Options: SAMEORIGIN` for clickjack prevention
2013-10-29 08:02:53 -07:00 · 2013-10-29 08:02:53 -07:00 · d0eecfbc53
parent 12ef8124cf 4f9aa6a92a
commit d0eecfbc53
3 changed files with 5 additions and 0 deletions
--- a/1
+++ b/1
@ -116,6 +116,7 @@ gem 'therubyracer', require: 'v8'
 gem 'thin', require: false
 gem 'diffy', '>= 3.0', require: false
 gem 'highline', require: false
+gem 'rack-protection' # security

 # Gem that enables support for plugins. It is required.
 gem 'discourse_plugin', path: 'vendor/gems/discourse_plugin'
--- a/Gemfile.lock
+++ b/Gemfile.lock
@ -522,6 +522,7 @@ DEPENDENCIES
  qunit-rails
  rack-cors
  rack-mini-profiler!
+  rack-protection
  rails (= 3.2.12)
  rails_multisite!
  rake
--- a/config/initializers/11-rack-protection.rb
+++ b/config/initializers/11-rack-protection.rb
@ -0,0 +1,3 @@
+require 'rack/protection'
+
+Rails.configuration.middleware.use Rack::Protection::FrameOptions