angular_rails_csrf 4.2.0 → 5.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4e8a320d5c0af2703ea102297a762789112438a32347be78810f9ed0a38f0944
-  data.tar.gz: 69b97e7968cc7969768432e5b37a73aae82525dc22aa4736aca1ef008f479568
+  metadata.gz: 777a87b5a6709b3c193f4205d7327790efa17a1a1d3686a8e49fc69b03e62e1b
+  data.tar.gz: b693aa26b63bc1772a8b14728414d3922e9a2c2a33be088f4f123ca06885c58a
 SHA512:
-  metadata.gz: 064c1ad9b08d278ba698c7e0deebd6a0169aeba2f665c9ada2e67fe08cc704cd7d1d21cb79d31be3bf55d985d951988e87239b67ca03169ea6b6bbaf740423aa
-  data.tar.gz: 9a6126ddfa20f2d162e569a277f539b5b15bceddc5f75f2321f8d2d5771b6b5de53c54a388397b91e7ee94d4a2bb08d812f01b230078f33d5d46884f7f67952a
+  metadata.gz: e0a0afe2adc0f5dd08d95c7776f219101a659e3ba4ad1ba4abc4392a5a8f6e70cb5c957174c443266665348be35d9a33936ec2b1aefa2abb6bf0cd7558933e72
+  data.tar.gz: 5bba0256727b1dd432178d5fe4405ae11d4591e2be1fee0d13ac9c4bdfe29108040b2247a3f7fa80d3f0d6c43a7e426ab47490db521b1f1ec659625ef397a18c

data/README.md

@@ -1,8 +1,9 @@
 ## AngularJS-style CSRF Protection for Rails
 
-[![Gem Version](https://badge.fury.io/rb/angular_rails_csrf.svg)](https://badge.fury.io/rb/angular_rails_csrf)
-[![Build Status](https://travis-ci.org/jsanders/angular_rails_csrf.svg)](https://travis-ci.org/jsanders/angular_rails_csrf)
+![Gem](https://img.shields.io/gem/v/angular_rails_csrf)
+[![Build Status](https://travis-ci.com/jsanders/angular_rails_csrf.svg?branch=master)](https://travis-ci.com/jsanders/angular_rails_csrf)
 [![Test Coverage](https://codecov.io/gh/jsanders/angular_rails_csrf/graph/badge.svg)](https://codecov.io/gh/jsanders/angular_rails_csrf)
+![Downloads total](https://img.shields.io/gem/dt/angular_rails_csrf)
 
 The AngularJS [ng.$http](http://docs.angularjs.org/api/ng.$http) service has built-in CSRF protection. By default, it looks for a cookie named `XSRF-TOKEN` and, if found, writes its value into an `X-XSRF-TOKEN` header, which the server compares with the CSRF token saved in the user's session.
 
@@ -16,11 +17,15 @@ Check [version compatibility](https://github.com/jsanders/angular_rails_csrf/wik
 
 Add this line to your application's *Gemfile*:
 
-    gem 'angular_rails_csrf'
+```ruby
+gem 'angular_rails_csrf'
+```
 
 And then execute:
 
-    $ bundle
+```console
+$ bundle
+```
 
 That's it!
 
@@ -80,6 +85,22 @@ end
 
 **NOTE**: When using `config.angular_rails_csrf_same_site = :none`, this gem automatically sets the cookie to `Secure` (`config.angular_rails_csrf_secure = true`) to comply with [the specifications](https://tools.ietf.org/html/draft-west-cookie-incrementalism-00).
 
+Please note that [Safari is known to have issues](https://bugs.webkit.org/show_bug.cgi?id=198181) with SameSite attribute set to `:none`.
+
+### HttpOnly Cookie
+
+To set the ["httponly" flag](https://owasp.org/www-community/HttpOnly) for your cookie, set the `angular_rails_csrf_httponly` option to `true`:
+
+```ruby
+# application.rb
+class Application < Rails::Application
+  #...
+  config.angular_rails_csrf_httponly = true
+end
+```
+
+`angular_rails_csrf_httponly` defaults to `false`.
+
 ### Exclusions
 
 Sometimes you will want to skip setting the XSRF token for certain controllers (for example, when using SSE or ActionCable, as discussed [here](https://github.com/jsanders/angular_rails_csrf/issues/7)):

data/Rakefile

@@ -21,8 +21,7 @@ Bundler::GemHelper.install_tasks
 require 'rake/testtask'
 
 Rake::TestTask.new(:test) do |t|
-  t.libs << 'lib'
-  t.libs << 'test'
+  t.libs = %w[lib test]
   t.pattern = 'test/**/*_test.rb'
   t.verbose = false
 end

data/lib/angular_rails_csrf/concern.rb

@@ -9,48 +9,37 @@ module AngularRailsCsrf
     end
 
     def set_xsrf_token_cookie
-      return unless protect_against_forgery? && !respond_to?(:__exclude_xsrf_token_cookie?)
+      return unless defined?(protect_against_forgery?) && protect_against_forgery? && !respond_to?(:__exclude_xsrf_token_cookie?)
 
       config = Rails.application.config
 
-      same_site = same_site_from config
-      secure = secure_from config
+      secure = option_from config, :angular_rails_csrf_secure
+      same_site = option_from config, :angular_rails_csrf_same_site, :lax
 
       cookie_options = {
         value: form_authenticity_token,
-        domain: domain_from(config),
+        domain: option_from(config, :angular_rails_csrf_domain),
         same_site: same_site,
+        httponly: option_from(config, :angular_rails_csrf_httponly, false),
         secure: same_site.eql?(:none) || secure
       }
 
-      cookie_name = cookie_name_from config
+      cookie_name = option_from(config,
+                                :angular_rails_csrf_cookie_name,
+                                'XSRF-TOKEN')
       cookies[cookie_name] = cookie_options
     end
 
     def verified_request?
-      if respond_to?(:valid_authenticity_token?, true)
-        super || valid_authenticity_token?(session, request.headers['X-XSRF-TOKEN'])
-      else
-        super || form_authenticity_token == request.headers['X-XSRF-TOKEN']
-      end
+      super || valid_authenticity_token?(session, request.headers['X-XSRF-TOKEN'])
     end
 
     private
 
-    def same_site_from(config)
-      config.respond_to?(:angular_rails_csrf_same_site) ? config.angular_rails_csrf_same_site : :lax
-    end
-
-    def secure_from(config)
-      config.angular_rails_csrf_secure if config.respond_to?(:angular_rails_csrf_secure)
-    end
-
-    def domain_from(config)
-      config.respond_to?(:angular_rails_csrf_domain) ? config.angular_rails_csrf_domain : nil
-    end
-
-    def cookie_name_from(config)
-      config.respond_to?(:angular_rails_csrf_cookie_name) ? config.angular_rails_csrf_cookie_name : 'XSRF-TOKEN'
+    # Fetches the given option from config
+    # If the option is not set, return a default value
+    def option_from(config, option, default = nil)
+      config.respond_to?(option) ? config.send(option) : default
     end
 
     module ClassMethods

data/lib/angular_rails_csrf/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module AngularRailsCsrf
-  VERSION = '4.2.0'
+  VERSION = '5.0.0'
 end

data/test/angular_rails_csrf_skip_test.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+require 'test_helper'
+
+class AngularRailsCsrfSkipTest < ActionController::TestCase
+  tests ApiController
+
+  test 'csrf-cookie is not set and no error if protect_against_forgery? is not defined' do
+    refute @controller.respond_to?(:protect_against_forgery?)
+    get :index
+    assert_nil cookies['XSRF-TOKEN']
+    assert_response :success
+  end
+end

data/test/angular_rails_csrf_test.rb

@@ -31,48 +31,65 @@ class AngularRailsCsrfTest < ActionController::TestCase
     assert_response :success
   end
 
-  test 'the domain is used if present' do
-    begin
-      config = Rails.application.config
-      def config.angular_rails_csrf_domain
-        :all
-      end
+  test 'csrf-cookie is not set if exclusion is enabled' do
+    refute @controller.respond_to?(:__exclude_xsrf_token_cookie?)
+    @controller.class_eval { exclude_xsrf_token_cookie }
+    get :index
+    assert_valid_cookie present: false
+    assert @controller.__exclude_xsrf_token_cookie?
+    assert_response :success
+  end
 
-      get :index
-      assert @response.headers['Set-Cookie'].include?('.test.host')
-      assert_valid_cookie
-      assert_response :success
-    ensure
-      config.instance_eval('undef :angular_rails_csrf_domain', __FILE__, __LINE__)
+  test 'the domain is used if present' do
+    config = Rails.application.config
+    def config.angular_rails_csrf_domain
+      :all
     end
+
+    get :index
+    assert @response.headers['Set-Cookie'].include?('.test.host')
+    assert_valid_cookie
+    assert_response :success
+  ensure
+    config.instance_eval('undef :angular_rails_csrf_domain', __FILE__, __LINE__)
   end
 
   test 'the secure flag is set if configured' do
-    begin
-      @request.headers['HTTPS'] = 'on'
+    @request.headers['HTTPS'] = 'on'
 
-      config = Rails.application.config
-      config.define_singleton_method(:angular_rails_csrf_secure) { true }
+    config = Rails.application.config
+    config.define_singleton_method(:angular_rails_csrf_secure) { true }
 
-      get :index
-      assert @response.headers['Set-Cookie'].include?('secure')
-      assert_valid_cookie
-      assert_response :success
-    ensure
-      @request.headers['HTTPS'] = nil
-      config.instance_eval('undef :angular_rails_csrf_secure', __FILE__, __LINE__)
-    end
+    get :index
+    assert @response.headers['Set-Cookie'].include?('secure')
+    assert_valid_cookie
+    assert_response :success
+  ensure
+    @request.headers['HTTPS'] = nil
+    config.instance_eval('undef :angular_rails_csrf_secure', __FILE__, __LINE__)
   end
 
   test 'a custom name is used if present' do
     use_custom_cookie_name do
       get :index
       assert @response.headers['Set-Cookie'].include?('CUSTOM-COOKIE-NAME')
-      assert_valid_cookie('CUSTOM-COOKIE-NAME')
+      assert_valid_cookie name: 'CUSTOM-COOKIE-NAME'
       assert_response :success
     end
   end
 
+  test 'the httponly flag is set if configured' do
+    config = Rails.application.config
+    config.define_singleton_method(:angular_rails_csrf_httponly) { true }
+
+    get :index
+    assert @response.headers['Set-Cookie'].include?('HttpOnly')
+    assert_valid_cookie
+    assert_response :success
+  ensure
+    config.instance_eval('undef :angular_rails_csrf_httponly', __FILE__, __LINE__)
+  end
+
   test 'same_site is set to Lax by default' do
     get :index
     assert @response.headers['Set-Cookie'].include?('SameSite=Lax')
@@ -81,34 +98,30 @@ class AngularRailsCsrfTest < ActionController::TestCase
   end
 
   test 'same_site can be configured' do
-    begin
-      config = Rails.application.config
-      config.define_singleton_method(:angular_rails_csrf_same_site) { :strict }
+    config = Rails.application.config
+    config.define_singleton_method(:angular_rails_csrf_same_site) { :strict }
 
-      get :index
-      assert @response.headers['Set-Cookie'].include?('SameSite=Strict')
-      assert_valid_cookie
-      assert_response :success
-    ensure
-      config.instance_eval('undef :angular_rails_csrf_same_site', __FILE__, __LINE__)
-    end
+    get :index
+    assert @response.headers['Set-Cookie'].include?('SameSite=Strict')
+    assert_valid_cookie
+    assert_response :success
+  ensure
+    config.instance_eval('undef :angular_rails_csrf_same_site', __FILE__, __LINE__)
   end
 
   test 'secure is set automatically when same_site is set to none' do
-    begin
-      @request.headers['HTTPS'] = 'on'
+    @request.headers['HTTPS'] = 'on'
 
-      config = Rails.application.config
-      config.define_singleton_method(:angular_rails_csrf_same_site) { :none }
+    config = Rails.application.config
+    config.define_singleton_method(:angular_rails_csrf_same_site) { :none }
 
-      get :index
-      assert @response.headers['Set-Cookie'].include?('SameSite=None')
-      assert @response.headers['Set-Cookie'].include?('secure')
-      assert_valid_cookie
-      assert_response :success
-    ensure
-      config.instance_eval('undef :angular_rails_csrf_same_site', __FILE__, __LINE__)
-    end
+    get :index
+    assert @response.headers['Set-Cookie'].include?('SameSite=None')
+    assert @response.headers['Set-Cookie'].include?('secure')
+    assert_valid_cookie
+    assert_response :success
+  ensure
+    config.instance_eval('undef :angular_rails_csrf_same_site', __FILE__, __LINE__)
   end
 
   private
@@ -119,12 +132,10 @@ class AngularRailsCsrfTest < ActionController::TestCase
     @request.headers['X-XSRF-TOKEN'] = value
   end
 
-  def assert_valid_cookie(name = 'XSRF-TOKEN')
-    if @controller.respond_to?(:valid_authenticity_token?, true)
-      assert @controller.send(:valid_authenticity_token?, session, cookies[name])
-    else
-      assert_equal @controller.send(:form_authenticity_token), cookies['XSRF-TOKEN']
-    end
+  def assert_valid_cookie(name: 'XSRF-TOKEN', present: true)
+    cookie_valid = @controller.send(:valid_authenticity_token?, session, cookies[name])
+    cookie_valid = !cookie_valid unless present
+    assert cookie_valid
   end
 
   def use_custom_cookie_name

data/test/dummy/app/controllers/api_controller.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class ApiController < ActionController::API
+  def index
+    head :ok
+  end
+end

data/test/dummy/config/routes.rb

@@ -5,4 +5,6 @@ Dummy::Application.routes.draw do
   post 'test' => 'application#create'
 
   get 'exclusions' => 'exclusions#index'
+
+  get 'index' => 'api#index'
 end

data/test/dummy/config.ru

@@ -2,5 +2,5 @@
 
 # This file is used by Rack-based servers to start the application.
 
-require ::File.expand_path('../config/environment', __FILE__)
+require ::File.expand_path('config/environment', __dir__)
 run Rails.application