Missing Security Headers (ARCH6141)

Key ruby.security.missing-security-headers · Severity info · Category security · CWE CWE-693

Missing security headers such as CSP, X-Content-Type-Options, and HSTS weaken browser-based protections. Set these headers on all HTML responses.

Incorrect

class ApplicationController < ActionController::Base
  # no security headers set
end

Correct

class ApplicationController < ActionController::Base
  before_action :set_security_headers

  private

  def set_security_headers
    response.set_header("X-Content-Type-Options", "nosniff")
    response.set_header("Content-Security-Policy", "default-src 'self'")
    response.set_header("Strict-Transport-Security", "max-age=31536000")
  end
end

Fix

Set CSP, X-Content-Type-Options: nosniff, and HSTS headers on every response.