From a59d10d3df21befac6da57d92aed3087b7c10d6a Mon Sep 17 00:00:00 2001
From: Eugen Rochko <eugen@zeonfederated.com>
Date: Wed, 2 Nov 2016 13:12:18 +0100
Subject: [PATCH] Fix missing default headers
---
config/application.rb | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/config/application.rb b/config/application.rb
index 92aecc8fc..552f4ec11 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -38,7 +38,9 @@ module Mastodon
end
config.action_dispatch.default_headers = {
- 'X-Frame-Options' => 'DENY'
+ 'X-Frame-Options' => 'DENY',
+ 'X-Content-Type-Options' => 'nosniff',
+ 'X-XSS-Protection' => '1; mode=block'
}
end
end