From 6806772346c4c5cfb64f4dfd388a44fb25adb2ff Mon Sep 17 00:00:00 2001 From: Pete Matsyburka Date: Mon, 18 May 2026 16:11:16 +0300 Subject: [PATCH] add security headers --- .../api/active_storage_blobs_proxy_controller.rb | 1 + .../api/active_storage_blobs_proxy_legacy_controller.rb | 1 + app/controllers/api/api_base_controller.rb | 4 ++++ config/application.rb | 8 ++++++++ 4 files changed, 14 insertions(+) diff --git a/app/controllers/api/active_storage_blobs_proxy_controller.rb b/app/controllers/api/active_storage_blobs_proxy_controller.rb index 8ade86c6..3fc0dd5e 100644 --- a/app/controllers/api/active_storage_blobs_proxy_controller.rb +++ b/app/controllers/api/active_storage_blobs_proxy_controller.rb @@ -9,6 +9,7 @@ module Api before_action :set_cors_headers before_action :set_noindex_headers + before_action :set_security_headers def show blob_uuid, purp, exp = ApplicationRecord.signed_id_verifier.verified(params[:signed_uuid]) diff --git a/app/controllers/api/active_storage_blobs_proxy_legacy_controller.rb b/app/controllers/api/active_storage_blobs_proxy_legacy_controller.rb index 77ad2c6a..2485b9fa 100644 --- a/app/controllers/api/active_storage_blobs_proxy_legacy_controller.rb +++ b/app/controllers/api/active_storage_blobs_proxy_legacy_controller.rb @@ -9,6 +9,7 @@ module Api before_action :set_cors_headers before_action :set_noindex_headers + before_action :set_security_headers # rubocop:disable Metrics def show diff --git a/app/controllers/api/api_base_controller.rb b/app/controllers/api/api_base_controller.rb index ff01fc8f..6d9e2185 100644 --- a/app/controllers/api/api_base_controller.rb +++ b/app/controllers/api/api_base_controller.rb @@ -102,6 +102,10 @@ module Api headers['X-Robots-Tag'] = 'noindex' end + def set_security_headers + response.headers['X-Content-Type-Options'] = 'nosniff' + end + def set_cors_headers headers['Access-Control-Allow-Origin'] = '*' headers['Access-Control-Allow-Methods'] = 'POST, GET, PUT, PATCH, DELETE, OPTIONS' diff --git a/config/application.rb b/config/application.rb index a2bcddaf..b9131dc3 100644 --- a/config/application.rb +++ b/config/application.rb @@ -25,6 +25,14 @@ module DocuSeal config.active_storage.draw_routes = ENV['MULTITENANT'] != 'true' + config.active_storage.content_types_to_serve_as_binary += %w[ + application/javascript + text/javascript + application/ecmascript + text/ecmascript + application/wasm + ] + config.i18n.available_locales = %i[en en-US en-GB es-ES fr-FR pt-PT de-DE it-IT nl-NL es it de fr nl pl uk cs pt he ar ko ja] config.i18n.fallbacks = [:en]