aaf-secure_headers 1.0.0 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 8be7288a84ac0614798af9cf4eb41ceaa8a5533b
-  data.tar.gz: 9d9456a3fa3206bf914b6e796e8043589303087a
+  metadata.gz: 0ecbca92ffa54de01c7a60cc1a3dee3ae58d364d
+  data.tar.gz: cd06533d81d0a835311c0f80196be0075537e831
 SHA512:
-  metadata.gz: 02217e8517f4d934d0d6c3e4c35cff0ae92f9025a69b19c3aff21308b1548d5cec2a4dad6a6aabacdbe5ec8ec25473aac33fd535a83a6126e97ea3ad5107291e
-  data.tar.gz: d1b0b74ec84056ad7c77787c2c17a2cb08cd65320700fbac72632ed85c82fcd86bde4155b89ae55668e0735ea899122e0f1c2cc766239a3231c1f89c738628ba
+  metadata.gz: 438ca38f427f1ddb1a36309bbd1197b95c130c2b97f6201b1ccbfdf961f8ce1cb53672870f8fe8f68d75556dac41ba6a63bc09729f2af81981744352d549e584
+  data.tar.gz: 192096b6d0ec62c86ceab51e0fc8d852c3c21cb663bde6548f32e2353b859b423225f11f42e1f25a6a979eb419a81b5f14dfeb7d4ec53fb81ad28c6036cbb487

data/.rspec

@@ -1,2 +1,3 @@
 --format documentation
 --color
+--require spec_helper

data/aaf-secure_headers.gemspec

@@ -27,4 +27,5 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency 'bundler', '~> 1.12'
   spec.add_development_dependency 'rake', '~> 10.0'
   spec.add_development_dependency 'rspec', '~> 3.0'
+  spec.add_development_dependency 'actionpack'
 end

data/lib/aaf/secure_headers.rb

@@ -1,4 +1,5 @@
 require 'aaf/secure_headers/version'
+require 'aaf/secure_headers/disable_secure_headers_for_error_pages'
 require 'secure_headers'
 require 'active_support/core_ext/integer/time'
 
@@ -37,5 +38,36 @@ module AAF
         report_uri: []
       }
     end
+
+    class <<self
+      def development_mode!
+        ensure_rails
+        insert_dev_middleware
+        override_dev_configuration
+      end
+
+      private
+
+      def ensure_rails
+        return if const_defined?('Rails')
+
+        raise 'The Rails class is not defined. The `development_mode!` helper '\
+              'can only be used in a Rails application.'
+      end
+
+      def insert_dev_middleware
+        Rails.application.config.middleware.insert_after(
+          ::SecureHeaders::Middleware,
+          AAF::SecureHeaders::DisableSecureHeadersForErrorPages
+        )
+      end
+
+      def override_dev_configuration
+        ::SecureHeaders::Configuration.override(:default) do |config|
+          config.hsts = nil
+          config.csp[:upgrade_insecure_requests] = false
+        end
+      end
+    end
   end
 end

data/lib/aaf/secure_headers/disable_secure_headers_for_error_pages.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module AAF
+  module SecureHeaders
+    class DisableSecureHeadersForErrorPages
+      def initialize(app)
+        @app = app
+      end
+
+      def call(env)
+        @app.call(env).tap do |(status, _, _)|
+          next if status < 400
+          request = ActionDispatch::Request.new(env)
+          ::SecureHeaders.opt_out_of_all_protection(request)
+        end
+      end
+    end
+  end
+end

data/lib/aaf/secure_headers/version.rb

@@ -1,5 +1,5 @@
 module AAF
   module SecureHeaders
-    VERSION = '1.0.0'.freeze
+    VERSION = '1.1.0'.freeze
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aaf-secure_headers
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.1.0
 platform: ruby
 authors:
 - Ryan Caught
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2016-10-03 00:00:00.000000000 Z
+date: 2016-11-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: secure_headers
@@ -80,6 +80,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3.0'
+- !ruby/object:Gem::Dependency
+  name: actionpack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Base configuration for AAF Secure Headers
 email:
 - ryan.caught@aaf.edu.au
@@ -98,6 +112,7 @@ files:
 - bin/console
 - bin/setup
 - lib/aaf/secure_headers.rb
+- lib/aaf/secure_headers/disable_secure_headers_for_error_pages.rb
 - lib/aaf/secure_headers/version.rb
 homepage: https://github.com/ausaccessfed/aaf-secure_headers
 licenses: []
@@ -118,7 +133,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.6
+rubygems_version: 2.6.7
 signing_key: 
 specification_version: 4
 summary: Base configuration for AAF Secure Headers