config/initializers/security_headers.rb

	security_headers.rb revision b049c4f1eb105fffb64f9c614c54e95137875dba
::SecureHeaders::Configuration.configure do |config|
  config.hsts                   = {:max_age => 99, :include_subdomains => true}
  config.x_frame_options        = 'DENY'
  config.x_content_type_options = "nosniff"
  config.x_xss_protection       = {:value => 1, :mode => false}
  config.csp                    = {
    default_src: "self",
    style_src:   "'self' 'unsafe-inline'",
    disable_chrome_extension: true,
  }
end