You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Following this change from this pull-request
It introduce a regression and an unwanted behavior with some headers.
While using SecureHeaders::OPT_OUT as a value to override the X-Frame-Options header we're not deleting the header.
It happens because here in railtie.rb
we are only looking for the lowercase key values.
The default written X-Frame-Options never get match because keys are case sensitive.
This is a potential bigger issue since looking a recent version of rails action_dispatch here it is still using the non lowercase keys.
Expected outcome
The header is removed from the headers list in the response when using SecureHeaders::OPT_OUT.
Actual outcome
Any Non downcase header with the SecureHeaders::OPT_OUT value doesn't get remove.
Bug
Gem version: 7.1.0
Rails: 6.1
Ruby: 3.3.6
Following this change from this pull-request
It introduce a regression and an unwanted behavior with some headers.
While using
SecureHeaders::OPT_OUT
as a value to override the X-Frame-Options header we're not deleting the header.It happens because here in railtie.rb
we are only looking for the lowercase key values.
The default written
X-Frame-Options
never get match because keys are case sensitive.This is a potential bigger issue since looking a recent version of rails action_dispatch here it is still using the non lowercase keys.
Expected outcome
SecureHeaders::OPT_OUT
.Actual outcome
SecureHeaders::OPT_OUT
value doesn't get remove.Suggestions:
The text was updated successfully, but these errors were encountered: