Marten::Middleware::CrossOriginOpenerPolicy
Inherits Marten::Middleware < Reference < Object
Sets the Cross-Origin-Opener-Policy header in the response if it wasn't already set.
When this middleware is used, a Cross-Origin-Opener-Policy header will be inserted into the HTTP response. The
value for this header is configurable in the cross_origin_opener_policy setting. This header allows browsers to
isolate a top-level window from other documents by putting them in a different browsing context group, which
mitigates cross-origin attacks that rely on window.opener.
The possible values for the Cross-Origin-Opener-Policy header include:
- unsafe-none: Allows the document to be added to its opener's browsing context group unless the opener itself has a COOP of same-origin or same-origin-allow-popups.
- same-origin-allow-popups: Isolates the browsing context to same-origin documents or those which either don't set COOP or which opt out of isolation by setting a COOP of unsafe-none.
- same-origin: Isolates the browsing context exclusively to same-origin documents. This is the default and most secure option.
- noopener-allow-popups: Isolates the browsing context and always sets
window.openertonullfor opened documents.
It is possible to define a custom header value on a per-handler basis by using the
#cross_origin_opener_policy method, or to disable the insertion of this header by using the
#exempt_from_cross_origin_opener_policy method.
Instance methods
Calls the middleware for a given HTTP request and returns a HTTP response.
This method must be implemented by subclasses: it takes a request argument (the current HTTP request) and a
get_response proc that allows to get the final response. This proc might actually call the next middleware in
the chain of configured middlewares, or the final matched handler. That way, the current middleware have the
ability to intercept any incoming request and the associated response, and to modify them if applicable.