Skip to content

Add BaseActionController to allow setting security headers

Drew Blessing requested to merge dblessing_cross_origin_opener_header into master

What does this MR do and why?

Part of #324395.

We need to add some security headers to all controllers in GitLab. ApplicationController is the logical place for this, except we have about a dozen cases where controllers don't want/need all the cruft of ApplicationController so they inherit directly from ActionController::Base.

This MR introduces a GitLab BaseActionController which inherits from ActionController::Base and only has minimal logic which we can safely use across all controllers. With this change, no controller in GitLab should inherit directly from ActionController::Base. We may want to introduce another Cop to help protect against this. But we already have Rails/ApplicationController bot which tries to ensure a controller doesn't inherit from anything other than ApplicationController.

All of this, so we can set the Cross-Origin-Opener-Policy header to same-origin. And this is wrapped in a feature flag in case the addition causes any unintended side-effects.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

Before After

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Drew Blessing

Merge request reports