Heroku's Sinatra app responds with Forbidden if I follow the links

Question

I created a small Sinatra application and use Puma to run it. I deployed my application to Heroku and everything works fine, but if I follow the external link to my application, I get a response Forbidden. Where does this come from?

An application defines only one HTTP method:

require 'sinatra'

get '/' do
  headers 'Content-Type' => 'application/json'
  body 'Hello World'
end

For example, the following https://contactsampleprovider.herokuapp.com/ will result Forbidden, but manually entering the URL in the browser is fine.

If I omit headers-call, everything works as expected.

Answer 1

Rack, , , , JSON.

set :protection, :except => [:json_csrf]

, , Sinatra Rack.