title: Setting HTTP response headers application-wide in Rails 3.2
body: <p>How do I set response headers application-wide in Rails 3.2?</p>
  
  <p>The Rails guides to security for <a href="http://guides.rubyonrails.org/v4.0.8/security.html" rel="noreferrer">4.0</a> mentions <code>config.action_dispatch.default_headers</code>:</p>
  
  <blockquote>
    <p>8 Default Headers</p>
    
    <p>Every HTTP response from your Rails application receives the following
    default security headers.</p>
  
  <pre><code>config.action_dispatch.default_headers = {
    'X-Frame-Options' =&gt; 'SAMEORIGIN',
    'X-XSS-Protection' =&gt; '1; mode=block',
    'X-Content-Type-Options' =&gt; 'nosniff'
  }
  </code></pre>
    
    <p>You can configure default headers in <code>config/application.rb</code>.</p>
  
  <pre><code>config.action_dispatch.default_headers = {
    'Header-Name' =&gt; 'Header-Value',
    'X-Frame-Options' =&gt; 'DENY'
  }
  </code></pre>
  </blockquote>
  
  <p>but I couldn't find anything about application-wide configuration of headers in the security guide for Rails <a href="http://guides.rubyonrails.org/v3.2/security.html#header-injection" rel="noreferrer">3.2</a>, or anything relevant in the <a href="http://guides.rubyonrails.org/v3.2/configuring.html" rel="noreferrer">configuring</a> guide for Rails 3.2. The answers in <a href="https://stackoverflow.com/questions/16654052/how-do-you-add-a-custom-http-header">How do you add a custom http header?</a> seem to either be addressing versions of Rails more recent than 3.2, or modify responses in controllers rather than application wide.</p>