Hanami provides ways to secure from most common vulnerabilities. Security options can be configured in .

X-Frame-Options is a HTTP header supported by modern browsers. It determines if a web page can or cannot be included via <frame> and <iframe> tags by untrusted domains.

# Allows iframes on example.com
security.x_frame_options 'ALLOW-FROM https://example.com/'

X-Content-Type-Options prevents browsers from interpreting files as something else than declared by the content type in the HTTP headers.

X-XSS-Protection is a HTTP header to determine the behavior of the browser in case an XSS attack is detected.

# Filter enabled. Rather than sanitize the page, when a XSS attack is detected,
# the browser will prevent rendering of the page (default)

# the browser will sanitize the page
security.x_xss_protection '1'

Web applications can send this header to mitigate Cross Site Scripting (XSS) attacks.

The default value allows images, scripts, AJAX, fonts and CSS from the same origin, and does not allow any other resources to load (eg object, frame, media, etc).

Default value is:

security.content_security_policy %{
  form-action 'self';
  frame-ancestors 'self';
  base-uri 'self';
  default-src 'none';
  img-src 'self' https: data:;
  style-src 'self' 'unsafe-inline' https:;
  font-src 'self';
  object-src 'none';
  plugin-types application/pdf;
  child-src 'self';
  frame-src 'self';
  media-src 'self'