From e6d2166bacf9398930020025e77ba6a2209d502e Mon Sep 17 00:00:00 2001 From: Omar Roth Date: Wed, 5 Sep 2018 21:51:40 -0500 Subject: [PATCH] Add X-XSS-Protection and X-Content-Type-Options --- src/invidious.cr | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/invidious.cr b/src/invidious.cr index 433c84c7..8fa9f581 100644 --- a/src/invidious.cr +++ b/src/invidious.cr @@ -106,6 +106,9 @@ spawn do end before_all do |env| + env.response.headers["X-XSS-Protection"] = "1; mode=block;" + env.response.headers["X-Content-Type-Options"] = "nosniff" + if env.request.cookies.has_key? "SID" headers = HTTP::Headers.new headers["Cookie"] = env.request.headers["Cookie"]