class Marten::Middleware::XContentTypeOptions

Overview

Sets the X-Content-Type-Options header in the response if it wasn't already set.

When this middleware is used, an X-Content-Type-Options: nosniff header will be inserted into the HTTP response unless that header is already present. This instructs browsers to always use the declared Content-Type instead of MIME-sniffing the response body, which helps mitigate certain cross-site scripting attacks involving mislabeled or user-uploaded content.

It is possible to disable the insertion of this header on a per-handler basis by using the #exempt_from_x_content_type_options method.

Defined in:

marten/middleware/x_content_type_options.cr

Instance Method Summary

Instance methods inherited from class Marten::Middleware

call(request : Marten::HTTP::Request, get_response : Proc(Marten::HTTP::Response)) : Marten::HTTP::Response call, next : Nil | Middleware next, next=(next __arg0 : Nil | Middleware) next=

Instance Method Detail

def call(request : Marten::HTTP::Request, get_response : Proc(Marten::HTTP::Response)) : Marten::HTTP::Response #
Description copied from class Marten::Middleware

Calls the middleware for a given HTTP request and returns a HTTP response.

This method must be implemented by subclasses: it takes a request argument (the current HTTP request) and a get_response proc that allows to get the final response. This proc might actually call the next middleware in the chain of configured middlewares, or the final matched handler. That way, the current middleware have the ability to intercept any incoming request and the associated response, and to modify them if applicable.


[View source]