12-oz/pliny — pull request #30 by catsby (2014-04-08 14:10:51+00:00)
Title: :WIP: Add SecureHeaders gem

:construction:

This pull request adds https://github.com/twitter/secureheaders to the project.

I think this mostly works, however, the `x_frame_options` doesn't do what I'd expect:

Before:
```console
$ curl -i http://localhost:5000
HTTP/1.1 200 OK
Content-Type: text/html;charset=utf-8
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Request-Id: 56b34354-b3a8-4b79-82a7-e9dfc9179029
Content-Length: 6

hello.%
```

After:

```console
$ curl -i http://localhost:5000
HTTP/1.1 200 OK
Content-Type: text/html;charset=utf-8
Content-Security-Policy-Report-Only: default-src 'none'; connect-src 'none'; font-src 'none'; frame-src 'none'; img-src 'none' data:; media-src 'none'; object-src 'none'; script-src 'none'; style-src 'none';
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Request-Id: 11005316-a923-42ee-b5a6-55af3091ac66
Content-Length: 6

hello.%
```

I'm not 100% sure all the headers are in there, and the `X-Frame-Options` still says `SAMEORIGIN`.