Add Cross-Origin-Opener-Policy header

tomhughes · tomhughes · commit 2ff4d6a4e633 · 2025-07-07T17:29:49.000+01:00
Reported-by: Sam Jose &lt;samjosep512@gmail.com&gt;
diff --git a/config/initializers/policy_headers.rb b/config/initializers/policy_headers.rb
@@ -0,0 +1,19 @@
+module OpenStreetMap
+  module Rack
+    class PolicyHeaders
+      COOP_HEADER = "Cross-Origin-Opener-Policy".freeze
+
+      def initialize(app)
+        @app = app
+      end
+
+      def call(env)
+        status, headers, response = @app.call(env)
+        headers[COOP_HEADER] = "same-origin" unless headers.key?(COOP_HEADER)
+        [status, headers, response]
+      end
+    end
+  end
+end
+
+Rails.configuration.middleware.use OpenStreetMap::Rack::PolicyHeaders
