# Default Security Headers

**URL:** <https://discuss.rubyonrails.org/t/default-security-headers/60525>\
**Category:** rubyonrails-core\
**Created:** [August 22, 2011, 11:25am UTC](https://discuss.rubyonrails.org/t/default-security-headers/60525 "2011-08-22T11:25:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![iain](https://avatars.discourse-cdn.com/v4/letter/i/d2c977/32.png) [@iain](https://discuss.rubyonrails.org/u/iain)\
**Post date:** [August 22, 2011, 11:25am UTC](https://discuss.rubyonrails.org/t/default-security-headers/60525/1 "2011-08-22T11:25:22Z")

</div>

I was reading an article on Google+ I found through Hackernews:

> **[Journey Notes - Your guide to a safer path](https://blog.barracuda.com)**
>
> Your guide to a safer path

I was wondering if these headers should be turned on by default in Rails?

As far as I know, some of them can be sent by default, while others can only be sent when force\_ssl is on.

---

<div class="post-metadata">

**Author:** ![Aaron\_Patterson1](https://avatars.discourse-cdn.com/v4/letter/a/e0b2c6/32.png) [@Aaron\_Patterson1](https://discuss.rubyonrails.org/u/Aaron_Patterson1)\
**Post date:** [August 22, 2011, 6:32pm UTC](https://discuss.rubyonrails.org/t/default-security-headers/60525/2 "2011-08-22T18:32:23Z")

</div>

I think adding the X Headers by default would be fine. I don't think we should muck with the cookie one though.