angular_csrf 0.1.2 → 0.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (12) hide show
  1. checksums.yaml +4 -4
  2. data/README.md +4 -4
  3. data/lib/angular_csrf.rb +1 -1
  4. data/lib/version.rb +1 -1
  5. data/spec/angular_csrf_spec.rb +11 -19
  6. data/spec/rails_app/Gemfile +1 -1
  7. data/spec/rails_app/Gemfile.lock +63 -38
  8. data/spec/rails_app/config/environments/production.rb +1 -1
  9. data/spec/rails_app/config/environments/test.rb +1 -1
  10. data/spec/rails_app/log/development.log +55 -0
  11. data/spec/rails_app/log/test.log +1156 -0
  12. metadata +2 -2
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: a9b8b252bd73aed6ea7580f2d471a095223ec598
4
- data.tar.gz: 36b7d8b1d0db47305ea40e0f3a72acf814e9563c
3
+ metadata.gz: d0d20b5f53013d30629c823691ed9c60419095a6
4
+ data.tar.gz: 936d25874e0f27d7850349e73402fc3939c52f03
5
5
  SHA512:
6
- metadata.gz: be590420c3690edb5ca2cf850929bc9aa80f5e246767a28ce44901802eafb15078becbe8c63994c1656982f6ed934eee33afeac595fae9d4741d1e1573ba7cab
7
- data.tar.gz: 3cb60b6217e35fed7f690ace981446f4502fdfe764bd852685cb4f2c86cf8d20727e6c3c69d86303630a64c2486bdef20e7c76c5c376ec4188c511c37ec4aac1
6
+ metadata.gz: 1d858874b318165898f9be2da58e192af0bf02375f6f9385ccc988800bede6681b52cfa840a13164e5ff0a483724cc137a2ec81d0e71a78437d42351125e711c
7
+ data.tar.gz: 5b481e2da6cabc859cb10c24c759b646b280de1caa1e0a8cc16cc41fa22e85f68a3c0f2973f902b16e47d9f0aa28878dc95982c3dfa75b67a49d5dcda9911a2f
data/README.md CHANGED
@@ -9,15 +9,15 @@ Extends Rails CSRF protection to play nicely with AngularJS.
9
9
  [![Dependency Status](https://gemnasium.com/Sinbadsoft/angular_csrf.svg)](https://gemnasium.com/Sinbadsoft/angular_csrf)
10
10
  [![Gem Version](https://badge.fury.io/rb/angular_csrf.svg)](http://badge.fury.io/rb/angular_csrf)
11
11
 
12
+ Once installed, angular_csrf **just works**: No need to change or configure neither the AngularJS javascript code
13
+ nor the Rails application.
14
+
12
15
  CSRF is an exploit that allows malicious websites to do unauthorized actions on a website that trusts the user.
13
16
  The angular_csrf gem extends the CSRF protection in Rails to match the naming convention used in AngularJS for the HTTP
14
17
  header and cookie token names
15
18
  (see [Cookie-to-Header Token](http://en.wikipedia.org/wiki/Cross-site_request_forgery#Cookie-to-Header_Token) CSRF
16
19
  protection strategy for more details).
17
20
 
18
- Once installed, angular_csrf "just works": No need to change or configure neither the AngularJS javascript code nor the
19
- Rails application.
20
-
21
21
  angular_csrf has a very small footprint and has only the rails gem as dependency.
22
22
 
23
23
  ## Getting Started
@@ -46,7 +46,7 @@ AngularJS [deals with CSRF protection](https://docs.angularjs.org/api/ng/service
46
46
  * Reads the CSRF protection token form a cookie, by default `XSRF-TOKEN`
47
47
  * Sends back the CSRF token as a http header, by default: `X-XSRF-TOKEN`
48
48
 
49
- angular_csrf makes the Rails application or API set the expected cookie token and read validate the
49
+ angular_csrf makes the Rails application or API set the expected cookie token and read and validate the
50
50
  http header sent by AngularJS. angular_csrf installs a Rails initializer
51
51
  [that extends the application controllers](https://github.com/Sinbadsoft/angular_csrf/blob/master/lib/angular_csrf.rb)
52
52
  to perform these tasks.
data/lib/angular_csrf.rb CHANGED
@@ -13,7 +13,7 @@ module AngularCsrf
13
13
 
14
14
  define_method :verified_request_with_angular_header? do
15
15
  verified_request_without_angular_header? ||
16
- form_authenticity_token == request.headers[ANGULAR_CSRF_HEADER_NAME]
16
+ valid_authenticity_token?(session, request.headers[ANGULAR_CSRF_HEADER_NAME])
17
17
  end
18
18
  alias_method_chain :verified_request?, :angular_header
19
19
  end
data/lib/version.rb CHANGED
@@ -1,3 +1,3 @@
1
1
  module AngularCsrf
2
- VERSION = '0.1.2'
2
+ VERSION = '0.1.3'
3
3
  end
data/spec/angular_csrf_spec.rb CHANGED
@@ -1,33 +1,25 @@
1
1
  require 'rails_helper'
2
2
 
3
3
  describe 'angular_csrf', type: :request do
4
- it 'sets expected AngularJS csrf cookie' do
4
+ it 'validates csrf protection using AngularJS set header name and with AngularJS cookie value' do
5
5
  get '/'
6
- expect(response.cookies[AngularCsrf::ANGULAR_CSRF_COOKIE_NAME]).to_not be_nil
7
- expect(response.cookies[AngularCsrf::ANGULAR_CSRF_COOKIE_NAME]).to eq(session[:_csrf_token])
8
- end
9
6
 
10
- it 'checks AngularJS csrf http header for csrf protection' do
11
- get '/'
12
- post '/', { }, AngularCsrf::ANGULAR_CSRF_HEADER_NAME => session[:_csrf_token]
13
- expect(response.status).to eq(201)
14
- end
7
+ expect do
8
+ post '/'
9
+ end.to raise_error(ActionController::InvalidAuthenticityToken)
15
10
 
16
- it 'not modify behavior for default csrf http header' do
17
- get '/'
18
- post '/', { }, 'X-CSRF-Token' => session[:_csrf_token]
11
+ post '/', { }, AngularCsrf::ANGULAR_CSRF_HEADER_NAME => response.cookies[AngularCsrf::ANGULAR_CSRF_COOKIE_NAME]
19
12
  expect(response.status).to eq(201)
20
13
  end
21
14
 
22
- it 'changes AngularJS csrf cookie value on csrf token change' do
15
+ it 'does not modify behavior for default csrf http header' do
23
16
  get '/'
24
- old_csrf_token = session[:_csrf_token]
25
17
 
26
- post '/create_and_reset_session', { },
27
- AngularCsrf::ANGULAR_CSRF_HEADER_NAME => response.cookies[AngularCsrf::ANGULAR_CSRF_COOKIE_NAME]
28
- expect(response.status).to eq(201)
18
+ expect do
19
+ post '/'
20
+ end.to raise_error(ActionController::InvalidAuthenticityToken)
29
21
 
30
- expect(response.cookies[AngularCsrf::ANGULAR_CSRF_COOKIE_NAME]).to_not eq(old_csrf_token)
31
- expect(response.cookies[AngularCsrf::ANGULAR_CSRF_COOKIE_NAME]).to eq(session[:_csrf_token])
22
+ post '/', { }, 'X-CSRF-Token' => session[:_csrf_token]
23
+ expect(response.status).to eq(201)
32
24
  end
33
25
  end
data/spec/rails_app/Gemfile CHANGED
@@ -1,4 +1,4 @@
1
1
  source 'https://rubygems.org'
2
2
 
3
- gem 'rails', '4.1.7'
3
+ gem 'rails', '4.2.0'
4
4
  gem 'angular_csrf', path: '../../'
data/spec/rails_app/Gemfile.lock CHANGED
@@ -1,74 +1,99 @@
1
1
  PATH
2
2
  remote: ../../
3
3
  specs:
4
- angular_csrf (0.1.0)
4
+ angular_csrf (0.1.3)
5
5
  rails (>= 3.1)
6
6
 
7
7
  GEM
8
8
  remote: https://rubygems.org/
9
9
  specs:
10
- actionmailer (4.1.7)
11
- actionpack (= 4.1.7)
12
- actionview (= 4.1.7)
10
+ actionmailer (4.2.0)
11
+ actionpack (= 4.2.0)
12
+ actionview (= 4.2.0)
13
+ activejob (= 4.2.0)
13
14
  mail (~> 2.5, >= 2.5.4)
14
- actionpack (4.1.7)
15
- actionview (= 4.1.7)
16
- activesupport (= 4.1.7)
17
- rack (~> 1.5.2)
15
+ rails-dom-testing (~> 1.0, >= 1.0.5)
16
+ actionpack (4.2.0)
17
+ actionview (= 4.2.0)
18
+ activesupport (= 4.2.0)
19
+ rack (~> 1.6.0)
18
20
  rack-test (~> 0.6.2)
19
- actionview (4.1.7)
20
- activesupport (= 4.1.7)
21
+ rails-dom-testing (~> 1.0, >= 1.0.5)
22
+ rails-html-sanitizer (~> 1.0, >= 1.0.1)
23
+ actionview (4.2.0)
24
+ activesupport (= 4.2.0)
21
25
  builder (~> 3.1)
22
26
  erubis (~> 2.7.0)
23
- activemodel (4.1.7)
24
- activesupport (= 4.1.7)
27
+ rails-dom-testing (~> 1.0, >= 1.0.5)
28
+ rails-html-sanitizer (~> 1.0, >= 1.0.1)
29
+ activejob (4.2.0)
30
+ activesupport (= 4.2.0)
31
+ globalid (>= 0.3.0)
32
+ activemodel (4.2.0)
33
+ activesupport (= 4.2.0)
25
34
  builder (~> 3.1)
26
- activerecord (4.1.7)
27
- activemodel (= 4.1.7)
28
- activesupport (= 4.1.7)
29
- arel (~> 5.0.0)
30
- activesupport (4.1.7)
31
- i18n (~> 0.6, >= 0.6.9)
35
+ activerecord (4.2.0)
36
+ activemodel (= 4.2.0)
37
+ activesupport (= 4.2.0)
38
+ arel (~> 6.0)
39
+ activesupport (4.2.0)
40
+ i18n (~> 0.7)
32
41
  json (~> 1.7, >= 1.7.7)
33
42
  minitest (~> 5.1)
34
- thread_safe (~> 0.1)
43
+ thread_safe (~> 0.3, >= 0.3.4)
35
44
  tzinfo (~> 1.1)
36
- arel (5.0.1.20140414130214)
45
+ arel (6.0.0)
37
46
  builder (3.2.2)
38
47
  erubis (2.7.0)
48
+ globalid (0.3.0)
49
+ activesupport (>= 4.1.0)
39
50
  hike (1.2.3)
40
- i18n (0.6.11)
51
+ i18n (0.7.0)
41
52
  json (1.8.1)
53
+ loofah (2.0.1)
54
+ nokogiri (>= 1.5.9)
42
55
  mail (2.6.3)
43
56
  mime-types (>= 1.16, < 3)
44
57
  mime-types (2.4.3)
45
- minitest (5.4.2)
58
+ mini_portile (0.6.1)
59
+ minitest (5.5.0)
46
60
  multi_json (1.10.1)
47
- rack (1.5.2)
61
+ nokogiri (1.6.5)
62
+ mini_portile (~> 0.6.0)
63
+ rack (1.6.0)
48
64
  rack-test (0.6.2)
49
65
  rack (>= 1.0)
50
- rails (4.1.7)
51
- actionmailer (= 4.1.7)
52
- actionpack (= 4.1.7)
53
- actionview (= 4.1.7)
54
- activemodel (= 4.1.7)
55
- activerecord (= 4.1.7)
56
- activesupport (= 4.1.7)
66
+ rails (4.2.0)
67
+ actionmailer (= 4.2.0)
68
+ actionpack (= 4.2.0)
69
+ actionview (= 4.2.0)
70
+ activejob (= 4.2.0)
71
+ activemodel (= 4.2.0)
72
+ activerecord (= 4.2.0)
73
+ activesupport (= 4.2.0)
57
74
  bundler (>= 1.3.0, < 2.0)
58
- railties (= 4.1.7)
59
- sprockets-rails (~> 2.0)
60
- railties (4.1.7)
61
- actionpack (= 4.1.7)
62
- activesupport (= 4.1.7)
75
+ railties (= 4.2.0)
76
+ sprockets-rails
77
+ rails-deprecated_sanitizer (1.0.3)
78
+ activesupport (>= 4.2.0.alpha)
79
+ rails-dom-testing (1.0.5)
80
+ activesupport (>= 4.2.0.beta, < 5.0)
81
+ nokogiri (~> 1.6.0)
82
+ rails-deprecated_sanitizer (>= 1.0.1)
83
+ rails-html-sanitizer (1.0.1)
84
+ loofah (~> 2.0)
85
+ railties (4.2.0)
86
+ actionpack (= 4.2.0)
87
+ activesupport (= 4.2.0)
63
88
  rake (>= 0.8.7)
64
89
  thor (>= 0.18.1, < 2.0)
65
- rake (10.3.2)
90
+ rake (10.4.2)
66
91
  sprockets (2.12.3)
67
92
  hike (~> 1.2)
68
93
  multi_json (~> 1.0)
69
94
  rack (~> 1.0)
70
95
  tilt (~> 1.1, != 1.3.0)
71
- sprockets-rails (2.2.0)
96
+ sprockets-rails (2.2.2)
72
97
  actionpack (>= 3.0)
73
98
  activesupport (>= 3.0)
74
99
  sprockets (>= 2.8, < 4.0)
@@ -83,4 +108,4 @@ PLATFORMS
83
108
 
84
109
  DEPENDENCIES
85
110
  angular_csrf!
86
- rails (= 4.1.7)
111
+ rails (= 4.2.0)
data/spec/rails_app/config/environments/production.rb CHANGED
@@ -20,7 +20,7 @@ Rails.application.configure do
20
20
  # config.action_dispatch.rack_cache = true
21
21
 
22
22
  # Disable Rails's static asset server (Apache or nginx will already do this).
23
- config.serve_static_assets = false
23
+ config.serve_static_files = false
24
24
 
25
25
 
26
26
  # Specifies the header that your server uses for sending files.
data/spec/rails_app/config/environments/test.rb CHANGED
@@ -13,7 +13,7 @@ Rails.application.configure do
13
13
  config.eager_load = false
14
14
 
15
15
  # Configure static asset server for tests with Cache-Control for performance.
16
- config.serve_static_assets = true
16
+ config.serve_static_files = true
17
17
  config.static_cache_control = 'public, max-age=3600'
18
18
 
19
19
  # Show full error reports and disable caching.
data/spec/rails_app/log/development.log CHANGED
@@ -18,3 +18,58 @@ Completed 200 OK in 0ms
18
18
  Started GET "/" for 127.0.0.1 at 2014-11-08 22:52:50 +0100
19
19
  Processing by GuineaPigController#index as HTML
20
20
  Completed 200 OK in 23ms
21
+
22
+
23
+ Started GET "/" for ::1 at 2014-12-29 16:05:04 +0100
24
+ Processing by GuineaPigController#index as HTML
25
+ Completed 200 OK in 7ms
26
+
27
+
28
+ Started GET "/" for ::1 at 2014-12-29 16:05:16 +0100
29
+ Processing by GuineaPigController#index as HTML
30
+ Completed 200 OK in 0ms
31
+
32
+
33
+ Started GET "/" for ::1 at 2014-12-29 16:05:43 +0100
34
+ Processing by GuineaPigController#index as HTML
35
+ Completed 200 OK in 1ms
36
+
37
+
38
+ Started GET "/" for ::1 at 2014-12-29 16:07:32 +0100
39
+ Processing by GuineaPigController#index as HTML
40
+ Completed 200 OK in 0ms
41
+
42
+
43
+ Started GET "/create" for ::1 at 2014-12-29 16:07:40 +0100
44
+
45
+ ActionController::RoutingError (No route matches [GET] "/create"):
46
+ actionpack (4.2.0) lib/action_dispatch/middleware/debug_exceptions.rb:21:in `call'
47
+ actionpack (4.2.0) lib/action_dispatch/middleware/show_exceptions.rb:30:in `call'
48
+ railties (4.2.0) lib/rails/rack/logger.rb:38:in `call_app'
49
+ railties (4.2.0) lib/rails/rack/logger.rb:20:in `block in call'
50
+ activesupport (4.2.0) lib/active_support/tagged_logging.rb:68:in `block in tagged'
51
+ activesupport (4.2.0) lib/active_support/tagged_logging.rb:26:in `tagged'
52
+ activesupport (4.2.0) lib/active_support/tagged_logging.rb:68:in `tagged'
53
+ railties (4.2.0) lib/rails/rack/logger.rb:20:in `call'
54
+ actionpack (4.2.0) lib/action_dispatch/middleware/request_id.rb:21:in `call'
55
+ rack (1.6.0) lib/rack/methodoverride.rb:22:in `call'
56
+ rack (1.6.0) lib/rack/runtime.rb:18:in `call'
57
+ activesupport (4.2.0) lib/active_support/cache/strategy/local_cache_middleware.rb:28:in `call'
58
+ rack (1.6.0) lib/rack/lock.rb:17:in `call'
59
+ actionpack (4.2.0) lib/action_dispatch/middleware/static.rb:113:in `call'
60
+ rack (1.6.0) lib/rack/sendfile.rb:113:in `call'
61
+ railties (4.2.0) lib/rails/engine.rb:518:in `call'
62
+ railties (4.2.0) lib/rails/application.rb:164:in `call'
63
+ rack (1.6.0) lib/rack/lock.rb:17:in `call'
64
+ rack (1.6.0) lib/rack/content_length.rb:15:in `call'
65
+ rack (1.6.0) lib/rack/handler/webrick.rb:89:in `service'
66
+ /Users/nakhli/.rvm/rubies/ruby-2.1.3/lib/ruby/2.1.0/webrick/httpserver.rb:138:in `service'
67
+ /Users/nakhli/.rvm/rubies/ruby-2.1.3/lib/ruby/2.1.0/webrick/httpserver.rb:94:in `run'
68
+ /Users/nakhli/.rvm/rubies/ruby-2.1.3/lib/ruby/2.1.0/webrick/server.rb:295:in `block in start_thread'
69
+
70
+
71
+ Rendered /Users/nakhli/.rvm/gems/ruby-2.1.3@angular_csrf/gems/actionpack-4.2.0/lib/action_dispatch/middleware/templates/rescues/_trace.html.erb (0.9ms)
72
+ Rendered /Users/nakhli/.rvm/gems/ruby-2.1.3@angular_csrf/gems/actionpack-4.2.0/lib/action_dispatch/middleware/templates/routes/_route.html.erb (0.5ms)
73
+ Rendered /Users/nakhli/.rvm/gems/ruby-2.1.3@angular_csrf/gems/actionpack-4.2.0/lib/action_dispatch/middleware/templates/routes/_table.html.erb (3.8ms)
74
+ Rendered /Users/nakhli/.rvm/gems/ruby-2.1.3@angular_csrf/gems/actionpack-4.2.0/lib/action_dispatch/middleware/templates/rescues/_request_and_response.html.erb (1.1ms)
75
+ Rendered /Users/nakhli/.rvm/gems/ruby-2.1.3@angular_csrf/gems/actionpack-4.2.0/lib/action_dispatch/middleware/templates/rescues/routing_error.html.erb within rescues/layout (19.4ms)