- Add project visibility icons to dashboard
- Enable secure cookies if https used
- Protect users/confirmation with rack_attack
+ - Default HTTP headers to protect against MIME-sniffing, force https if enabled
v6.4.3
- Don't use unicorn worker killer if PhusionPassenger is defined
headers['X-Frame-Options'] = 'DENY'
headers['X-XSS-Protection'] = '1; mode=block'
headers['X-UA-Compatible'] = 'IE=edge'
+ headers['X-Content-Type-Options'] = 'nosniff'
+ headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains' if Gitlab.config.gitlab.https
end
def add_gon_variables