angular_rails_csrf 4.4.0 → 4.5.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/README.md +14 -0
- data/lib/angular_rails_csrf/concern.rb +11 -18
- data/lib/angular_rails_csrf/version.rb +1 -1
- data/test/angular_rails_csrf_test.rb +12 -0
- data/test/dummy/log/test.log +288 -0
- metadata +4 -4
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: fbbe5d4e901a8407bab7ff813f821b21461330470f2e6002d4e3d1a818eea858
|
|
4
|
+
data.tar.gz: 0e69f2eefcb28ae04e1b3de4ba04d00e6e3977235b725fa26d83d46ce33bcd3f
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 8ab71939bec130bfc22e79dabff8e904591990c178b03de610cb5592aa41bb6aeab73cf34340efe77592179c94b1b455029ee50f94955eca2f2bb28955f4f3f1
|
|
7
|
+
data.tar.gz: 0571fe4d59a0ed421942c37f357d34b3fd05f2fa8f5a98801d327d9054bf8cb5123f4b2c833053a34e82d96d103e53300d29c3303628c1c6d2a2d63bd43c07b7
|
data/README.md
CHANGED
|
@@ -82,6 +82,20 @@ end
|
|
|
82
82
|
|
|
83
83
|
Please note that [Safari is known to have issues](https://bugs.webkit.org/show_bug.cgi?id=198181) with SameSite attribute set to `:none`.
|
|
84
84
|
|
|
85
|
+
### HttpOnly Cookie
|
|
86
|
+
|
|
87
|
+
To set the ["httponly" flag](https://owasp.org/www-community/HttpOnly) for your cookie, set the `angular_rails_csrf_httponly` option to `true`:
|
|
88
|
+
|
|
89
|
+
```ruby
|
|
90
|
+
# application.rb
|
|
91
|
+
class Application < Rails::Application
|
|
92
|
+
#...
|
|
93
|
+
config.angular_rails_csrf_httponly = true
|
|
94
|
+
end
|
|
95
|
+
```
|
|
96
|
+
|
|
97
|
+
`angular_rails_csrf_httponly` defaults to `false`.
|
|
98
|
+
|
|
85
99
|
### Exclusions
|
|
86
100
|
|
|
87
101
|
Sometimes you will want to skip setting the XSRF token for certain controllers (for example, when using SSE or ActionCable, as discussed [here](https://github.com/jsanders/angular_rails_csrf/issues/7)):
|
|
@@ -13,17 +13,20 @@ module AngularRailsCsrf
|
|
|
13
13
|
|
|
14
14
|
config = Rails.application.config
|
|
15
15
|
|
|
16
|
-
|
|
17
|
-
|
|
16
|
+
secure = option_from config, :angular_rails_csrf_secure
|
|
17
|
+
same_site = option_from config, :angular_rails_csrf_same_site, :lax
|
|
18
18
|
|
|
19
19
|
cookie_options = {
|
|
20
20
|
value: form_authenticity_token,
|
|
21
|
-
domain:
|
|
21
|
+
domain: option_from(config, :angular_rails_csrf_domain),
|
|
22
22
|
same_site: same_site,
|
|
23
|
+
httponly: option_from(config, :angular_rails_csrf_httponly, false),
|
|
23
24
|
secure: same_site.eql?(:none) || secure
|
|
24
25
|
}
|
|
25
26
|
|
|
26
|
-
cookie_name =
|
|
27
|
+
cookie_name = option_from(config,
|
|
28
|
+
:angular_rails_csrf_cookie_name,
|
|
29
|
+
'XSRF-TOKEN')
|
|
27
30
|
cookies[cookie_name] = cookie_options
|
|
28
31
|
end
|
|
29
32
|
|
|
@@ -33,20 +36,10 @@ module AngularRailsCsrf
|
|
|
33
36
|
|
|
34
37
|
private
|
|
35
38
|
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
def secure_from(config)
|
|
41
|
-
config.angular_rails_csrf_secure if config.respond_to?(:angular_rails_csrf_secure)
|
|
42
|
-
end
|
|
43
|
-
|
|
44
|
-
def domain_from(config)
|
|
45
|
-
config.respond_to?(:angular_rails_csrf_domain) ? config.angular_rails_csrf_domain : nil
|
|
46
|
-
end
|
|
47
|
-
|
|
48
|
-
def cookie_name_from(config)
|
|
49
|
-
config.respond_to?(:angular_rails_csrf_cookie_name) ? config.angular_rails_csrf_cookie_name : 'XSRF-TOKEN'
|
|
39
|
+
# Fetches the given option from config
|
|
40
|
+
# If the option is not set, return a default value
|
|
41
|
+
def option_from(config, option, default = nil)
|
|
42
|
+
config.respond_to?(option) ? config.send(option) : default
|
|
50
43
|
end
|
|
51
44
|
|
|
52
45
|
module ClassMethods
|
|
@@ -78,6 +78,18 @@ class AngularRailsCsrfTest < ActionController::TestCase
|
|
|
78
78
|
end
|
|
79
79
|
end
|
|
80
80
|
|
|
81
|
+
test 'the httponly flag is set if configured' do
|
|
82
|
+
config = Rails.application.config
|
|
83
|
+
config.define_singleton_method(:angular_rails_csrf_httponly) { true }
|
|
84
|
+
|
|
85
|
+
get :index
|
|
86
|
+
assert @response.headers['Set-Cookie'].include?('HttpOnly')
|
|
87
|
+
assert_valid_cookie
|
|
88
|
+
assert_response :success
|
|
89
|
+
ensure
|
|
90
|
+
config.instance_eval('undef :angular_rails_csrf_httponly', __FILE__, __LINE__)
|
|
91
|
+
end
|
|
92
|
+
|
|
81
93
|
test 'same_site is set to Lax by default' do
|
|
82
94
|
get :index
|
|
83
95
|
assert @response.headers['Set-Cookie'].include?('SameSite=Lax')
|
data/test/dummy/log/test.log
CHANGED
|
@@ -1934,3 +1934,291 @@ AngularRailsCsrfSkipTest: test_csrf-cookie_is_not_set_and_no_error_if_protect_ag
|
|
|
1934
1934
|
-------------------------------------------------------------------------------------------------------------
|
|
1935
1935
|
Processing by ApiController#index as HTML
|
|
1936
1936
|
Completed 200 OK in 0ms (Allocations: 84)
|
|
1937
|
+
-------------------------------------------------------------------------------------------------------------
|
|
1938
|
+
AngularRailsCsrfSkipTest: test_csrf-cookie_is_not_set_and_no_error_if_protect_against_forgery?_is_not_defined
|
|
1939
|
+
-------------------------------------------------------------------------------------------------------------
|
|
1940
|
+
Processing by ApiController#index as HTML
|
|
1941
|
+
Completed 200 OK in 0ms (Allocations: 88)
|
|
1942
|
+
-----------------------------------------------------------------------------
|
|
1943
|
+
AngularRailsCsrfTest: test_a_post_is_accepted_if_X-XSRF-TOKEN_is_set_properly
|
|
1944
|
+
-----------------------------------------------------------------------------
|
|
1945
|
+
Processing by ApplicationController#create as HTML
|
|
1946
|
+
Completed 200 OK in 0ms (Allocations: 192)
|
|
1947
|
+
-----------------------------------------------------------------
|
|
1948
|
+
AngularRailsCsrfTest: test_the_httponly_flag_is_set_if_configured
|
|
1949
|
+
-----------------------------------------------------------------
|
|
1950
|
+
Processing by ApplicationController#index as HTML
|
|
1951
|
+
Completed 200 OK in 0ms (Allocations: 105)
|
|
1952
|
+
-------------------------------------------------------------------------
|
|
1953
|
+
AngularRailsCsrfTest: test_csrf-cookie_is_not_set_if_exclusion_is_enabled
|
|
1954
|
+
-------------------------------------------------------------------------
|
|
1955
|
+
Processing by ApplicationController#index as HTML
|
|
1956
|
+
Completed 200 OK in 0ms (Allocations: 74)
|
|
1957
|
+
-------------------------------------------------------------
|
|
1958
|
+
AngularRailsCsrfTest: test_same_site_is_set_to_Lax_by_default
|
|
1959
|
+
-------------------------------------------------------------
|
|
1960
|
+
Processing by ApplicationController#index as HTML
|
|
1961
|
+
Completed 200 OK in 0ms (Allocations: 104)
|
|
1962
|
+
--------------------------------------------------------
|
|
1963
|
+
AngularRailsCsrfTest: test_the_domain_is_used_if_present
|
|
1964
|
+
--------------------------------------------------------
|
|
1965
|
+
Processing by ApplicationController#index as HTML
|
|
1966
|
+
Completed 200 OK in 0ms (Allocations: 115)
|
|
1967
|
+
------------------------------------------------------------------------------------
|
|
1968
|
+
AngularRailsCsrfTest: test_secure_is_set_automatically_when_same_site_is_set_to_none
|
|
1969
|
+
------------------------------------------------------------------------------------
|
|
1970
|
+
Processing by ApplicationController#index as HTML
|
|
1971
|
+
Completed 200 OK in 0ms (Allocations: 104)
|
|
1972
|
+
--------------------------------------------------------------------------------------------------------
|
|
1973
|
+
AngularRailsCsrfTest: test_a_get_sets_the_XSRF-TOKEN_cookie_but_does_not_require_the_X-XSRF-TOKEN_header
|
|
1974
|
+
--------------------------------------------------------------------------------------------------------
|
|
1975
|
+
Processing by ApplicationController#index as HTML
|
|
1976
|
+
Completed 200 OK in 0ms (Allocations: 104)
|
|
1977
|
+
-----------------------------------------------------------
|
|
1978
|
+
AngularRailsCsrfTest: test_a_custom_name_is_used_if_present
|
|
1979
|
+
-----------------------------------------------------------
|
|
1980
|
+
Processing by ApplicationController#index as HTML
|
|
1981
|
+
Completed 200 OK in 0ms (Allocations: 104)
|
|
1982
|
+
---------------------------------------------------------------
|
|
1983
|
+
AngularRailsCsrfTest: test_the_secure_flag_is_set_if_configured
|
|
1984
|
+
---------------------------------------------------------------
|
|
1985
|
+
Processing by ApplicationController#index as HTML
|
|
1986
|
+
Completed 200 OK in 0ms (Allocations: 104)
|
|
1987
|
+
-----------------------------------------------------------------------------------------------------
|
|
1988
|
+
AngularRailsCsrfTest: test_a_post_raises_an_error_with_the_X-XSRF-TOKEN_header_set_to_the_wrong_value
|
|
1989
|
+
-----------------------------------------------------------------------------------------------------
|
|
1990
|
+
Processing by ApplicationController#create as HTML
|
|
1991
|
+
Can't verify CSRF token authenticity.
|
|
1992
|
+
Completed 422 Unprocessable Entity in 0ms (Allocations: 110)
|
|
1993
|
+
------------------------------------------------------
|
|
1994
|
+
AngularRailsCsrfTest: test_same_site_can_be_configured
|
|
1995
|
+
------------------------------------------------------
|
|
1996
|
+
Processing by ApplicationController#index as HTML
|
|
1997
|
+
Completed 200 OK in 0ms (Allocations: 104)
|
|
1998
|
+
-------------------------------------------------------------------------------------
|
|
1999
|
+
AngularRailsCsrfTest: test_a_post_raises_an_error_without_the_X-XSRF-TOKEN_header_set
|
|
2000
|
+
-------------------------------------------------------------------------------------
|
|
2001
|
+
Processing by ApplicationController#create as HTML
|
|
2002
|
+
Can't verify CSRF token authenticity.
|
|
2003
|
+
Completed 422 Unprocessable Entity in 0ms (Allocations: 98)
|
|
2004
|
+
----------------------------------------------------------------------------
|
|
2005
|
+
AngularRailsCsrfExceptionTest: test_a_get_does_not_set_the_XSRF-TOKEN_cookie
|
|
2006
|
+
----------------------------------------------------------------------------
|
|
2007
|
+
Processing by ExclusionsController#index as HTML
|
|
2008
|
+
Completed 200 OK in 0ms (Allocations: 71)
|
|
2009
|
+
-------------------------------------------------------------------------------------------------------------
|
|
2010
|
+
AngularRailsCsrfSkipTest: test_csrf-cookie_is_not_set_and_no_error_if_protect_against_forgery?_is_not_defined
|
|
2011
|
+
-------------------------------------------------------------------------------------------------------------
|
|
2012
|
+
Processing by ApiController#index as HTML
|
|
2013
|
+
Completed 200 OK in 0ms (Allocations: 88)
|
|
2014
|
+
-----------------------------------------------------------
|
|
2015
|
+
AngularRailsCsrfTest: test_a_custom_name_is_used_if_present
|
|
2016
|
+
-----------------------------------------------------------
|
|
2017
|
+
Processing by ApplicationController#index as HTML
|
|
2018
|
+
Completed 500 Internal Server Error in 12ms (Allocations: 3012)
|
|
2019
|
+
------------------------------------------------------
|
|
2020
|
+
AngularRailsCsrfTest: test_same_site_can_be_configured
|
|
2021
|
+
------------------------------------------------------
|
|
2022
|
+
Processing by ApplicationController#index as HTML
|
|
2023
|
+
Completed 500 Internal Server Error in 5ms (Allocations: 2927)
|
|
2024
|
+
-----------------------------------------------------------------------------------------------------
|
|
2025
|
+
AngularRailsCsrfTest: test_a_post_raises_an_error_with_the_X-XSRF-TOKEN_header_set_to_the_wrong_value
|
|
2026
|
+
-----------------------------------------------------------------------------------------------------
|
|
2027
|
+
Processing by ApplicationController#create as HTML
|
|
2028
|
+
Can't verify CSRF token authenticity.
|
|
2029
|
+
Completed 422 Unprocessable Entity in 0ms (Allocations: 111)
|
|
2030
|
+
--------------------------------------------------------------------------------------------------------
|
|
2031
|
+
AngularRailsCsrfTest: test_a_get_sets_the_XSRF-TOKEN_cookie_but_does_not_require_the_X-XSRF-TOKEN_header
|
|
2032
|
+
--------------------------------------------------------------------------------------------------------
|
|
2033
|
+
Processing by ApplicationController#index as HTML
|
|
2034
|
+
Completed 500 Internal Server Error in 6ms (Allocations: 2927)
|
|
2035
|
+
---------------------------------------------------------------
|
|
2036
|
+
AngularRailsCsrfTest: test_the_secure_flag_is_set_if_configured
|
|
2037
|
+
---------------------------------------------------------------
|
|
2038
|
+
Processing by ApplicationController#index as HTML
|
|
2039
|
+
Completed 500 Internal Server Error in 5ms (Allocations: 2927)
|
|
2040
|
+
------------------------------------------------------------------------------------
|
|
2041
|
+
AngularRailsCsrfTest: test_secure_is_set_automatically_when_same_site_is_set_to_none
|
|
2042
|
+
------------------------------------------------------------------------------------
|
|
2043
|
+
Processing by ApplicationController#index as HTML
|
|
2044
|
+
Completed 500 Internal Server Error in 5ms (Allocations: 2927)
|
|
2045
|
+
--------------------------------------------------------
|
|
2046
|
+
AngularRailsCsrfTest: test_the_domain_is_used_if_present
|
|
2047
|
+
--------------------------------------------------------
|
|
2048
|
+
Processing by ApplicationController#index as HTML
|
|
2049
|
+
Completed 500 Internal Server Error in 5ms (Allocations: 2927)
|
|
2050
|
+
-----------------------------------------------------------------------------
|
|
2051
|
+
AngularRailsCsrfTest: test_a_post_is_accepted_if_X-XSRF-TOKEN_is_set_properly
|
|
2052
|
+
-----------------------------------------------------------------------------
|
|
2053
|
+
Processing by ApplicationController#create as HTML
|
|
2054
|
+
Completed 500 Internal Server Error in 6ms (Allocations: 3046)
|
|
2055
|
+
-------------------------------------------------------------
|
|
2056
|
+
AngularRailsCsrfTest: test_same_site_is_set_to_Lax_by_default
|
|
2057
|
+
-------------------------------------------------------------
|
|
2058
|
+
Processing by ApplicationController#index as HTML
|
|
2059
|
+
Completed 500 Internal Server Error in 5ms (Allocations: 2927)
|
|
2060
|
+
-------------------------------------------------------------------------
|
|
2061
|
+
AngularRailsCsrfTest: test_csrf-cookie_is_not_set_if_exclusion_is_enabled
|
|
2062
|
+
-------------------------------------------------------------------------
|
|
2063
|
+
Processing by ApplicationController#index as HTML
|
|
2064
|
+
Completed 200 OK in 0ms (Allocations: 74)
|
|
2065
|
+
-----------------------------------------------------------------
|
|
2066
|
+
AngularRailsCsrfTest: test_the_httponly_flag_is_set_if_configured
|
|
2067
|
+
-----------------------------------------------------------------
|
|
2068
|
+
Processing by ApplicationController#index as HTML
|
|
2069
|
+
Completed 500 Internal Server Error in 5ms (Allocations: 2927)
|
|
2070
|
+
-------------------------------------------------------------------------------------
|
|
2071
|
+
AngularRailsCsrfTest: test_a_post_raises_an_error_without_the_X-XSRF-TOKEN_header_set
|
|
2072
|
+
-------------------------------------------------------------------------------------
|
|
2073
|
+
Processing by ApplicationController#create as HTML
|
|
2074
|
+
Can't verify CSRF token authenticity.
|
|
2075
|
+
Completed 422 Unprocessable Entity in 0ms (Allocations: 98)
|
|
2076
|
+
----------------------------------------------------------------------------
|
|
2077
|
+
AngularRailsCsrfExceptionTest: test_a_get_does_not_set_the_XSRF-TOKEN_cookie
|
|
2078
|
+
----------------------------------------------------------------------------
|
|
2079
|
+
Processing by ExclusionsController#index as HTML
|
|
2080
|
+
Completed 200 OK in 0ms (Allocations: 71)
|
|
2081
|
+
-------------------------------------------------------------------------------------------------------------
|
|
2082
|
+
AngularRailsCsrfSkipTest: test_csrf-cookie_is_not_set_and_no_error_if_protect_against_forgery?_is_not_defined
|
|
2083
|
+
-------------------------------------------------------------------------------------------------------------
|
|
2084
|
+
Processing by ApiController#index as HTML
|
|
2085
|
+
Completed 200 OK in 0ms (Allocations: 88)
|
|
2086
|
+
-------------------------------------------------------------------------
|
|
2087
|
+
AngularRailsCsrfTest: test_csrf-cookie_is_not_set_if_exclusion_is_enabled
|
|
2088
|
+
-------------------------------------------------------------------------
|
|
2089
|
+
Processing by ApplicationController#index as HTML
|
|
2090
|
+
Completed 200 OK in 0ms (Allocations: 128)
|
|
2091
|
+
------------------------------------------------------------------------------------
|
|
2092
|
+
AngularRailsCsrfTest: test_secure_is_set_automatically_when_same_site_is_set_to_none
|
|
2093
|
+
------------------------------------------------------------------------------------
|
|
2094
|
+
Processing by ApplicationController#index as HTML
|
|
2095
|
+
Completed 200 OK in 0ms (Allocations: 114)
|
|
2096
|
+
-----------------------------------------------------------
|
|
2097
|
+
AngularRailsCsrfTest: test_a_custom_name_is_used_if_present
|
|
2098
|
+
-----------------------------------------------------------
|
|
2099
|
+
Processing by ApplicationController#index as HTML
|
|
2100
|
+
Completed 200 OK in 1ms (Allocations: 104)
|
|
2101
|
+
------------------------------------------------------
|
|
2102
|
+
AngularRailsCsrfTest: test_same_site_can_be_configured
|
|
2103
|
+
------------------------------------------------------
|
|
2104
|
+
Processing by ApplicationController#index as HTML
|
|
2105
|
+
Completed 200 OK in 0ms (Allocations: 104)
|
|
2106
|
+
-----------------------------------------------------------------------------------------------------
|
|
2107
|
+
AngularRailsCsrfTest: test_a_post_raises_an_error_with_the_X-XSRF-TOKEN_header_set_to_the_wrong_value
|
|
2108
|
+
-----------------------------------------------------------------------------------------------------
|
|
2109
|
+
Processing by ApplicationController#create as HTML
|
|
2110
|
+
Can't verify CSRF token authenticity.
|
|
2111
|
+
Completed 422 Unprocessable Entity in 0ms (Allocations: 116)
|
|
2112
|
+
-----------------------------------------------------------------
|
|
2113
|
+
AngularRailsCsrfTest: test_the_httponly_flag_is_set_if_configured
|
|
2114
|
+
-----------------------------------------------------------------
|
|
2115
|
+
Processing by ApplicationController#index as HTML
|
|
2116
|
+
Completed 200 OK in 0ms (Allocations: 104)
|
|
2117
|
+
--------------------------------------------------------
|
|
2118
|
+
AngularRailsCsrfTest: test_the_domain_is_used_if_present
|
|
2119
|
+
--------------------------------------------------------
|
|
2120
|
+
Processing by ApplicationController#index as HTML
|
|
2121
|
+
Completed 200 OK in 0ms (Allocations: 115)
|
|
2122
|
+
-------------------------------------------------------------------------------------
|
|
2123
|
+
AngularRailsCsrfTest: test_a_post_raises_an_error_without_the_X-XSRF-TOKEN_header_set
|
|
2124
|
+
-------------------------------------------------------------------------------------
|
|
2125
|
+
Processing by ApplicationController#create as HTML
|
|
2126
|
+
Can't verify CSRF token authenticity.
|
|
2127
|
+
Completed 422 Unprocessable Entity in 0ms (Allocations: 98)
|
|
2128
|
+
--------------------------------------------------------------------------------------------------------
|
|
2129
|
+
AngularRailsCsrfTest: test_a_get_sets_the_XSRF-TOKEN_cookie_but_does_not_require_the_X-XSRF-TOKEN_header
|
|
2130
|
+
--------------------------------------------------------------------------------------------------------
|
|
2131
|
+
Processing by ApplicationController#index as HTML
|
|
2132
|
+
Completed 200 OK in 0ms (Allocations: 104)
|
|
2133
|
+
---------------------------------------------------------------
|
|
2134
|
+
AngularRailsCsrfTest: test_the_secure_flag_is_set_if_configured
|
|
2135
|
+
---------------------------------------------------------------
|
|
2136
|
+
Processing by ApplicationController#index as HTML
|
|
2137
|
+
Completed 200 OK in 0ms (Allocations: 104)
|
|
2138
|
+
-----------------------------------------------------------------------------
|
|
2139
|
+
AngularRailsCsrfTest: test_a_post_is_accepted_if_X-XSRF-TOKEN_is_set_properly
|
|
2140
|
+
-----------------------------------------------------------------------------
|
|
2141
|
+
Processing by ApplicationController#create as HTML
|
|
2142
|
+
Completed 200 OK in 0ms (Allocations: 125)
|
|
2143
|
+
-------------------------------------------------------------
|
|
2144
|
+
AngularRailsCsrfTest: test_same_site_is_set_to_Lax_by_default
|
|
2145
|
+
-------------------------------------------------------------
|
|
2146
|
+
Processing by ApplicationController#index as HTML
|
|
2147
|
+
Completed 200 OK in 0ms (Allocations: 104)
|
|
2148
|
+
----------------------------------------------------------------------------
|
|
2149
|
+
AngularRailsCsrfExceptionTest: test_a_get_does_not_set_the_XSRF-TOKEN_cookie
|
|
2150
|
+
----------------------------------------------------------------------------
|
|
2151
|
+
Processing by ExclusionsController#index as HTML
|
|
2152
|
+
Completed 200 OK in 0ms (Allocations: 71)
|
|
2153
|
+
-------------------------------------------------------------------------------------------------------------
|
|
2154
|
+
AngularRailsCsrfSkipTest: test_csrf-cookie_is_not_set_and_no_error_if_protect_against_forgery?_is_not_defined
|
|
2155
|
+
-------------------------------------------------------------------------------------------------------------
|
|
2156
|
+
Processing by ApiController#index as HTML
|
|
2157
|
+
Completed 200 OK in 0ms (Allocations: 88)
|
|
2158
|
+
-----------------------------------------------------------------
|
|
2159
|
+
AngularRailsCsrfTest: test_the_httponly_flag_is_set_if_configured
|
|
2160
|
+
-----------------------------------------------------------------
|
|
2161
|
+
Processing by ApplicationController#index as HTML
|
|
2162
|
+
Completed 200 OK in 0ms (Allocations: 168)
|
|
2163
|
+
-----------------------------------------------------------------------------
|
|
2164
|
+
AngularRailsCsrfTest: test_a_post_is_accepted_if_X-XSRF-TOKEN_is_set_properly
|
|
2165
|
+
-----------------------------------------------------------------------------
|
|
2166
|
+
Processing by ApplicationController#create as HTML
|
|
2167
|
+
Completed 200 OK in 0ms (Allocations: 131)
|
|
2168
|
+
-------------------------------------------------------------------------------------
|
|
2169
|
+
AngularRailsCsrfTest: test_a_post_raises_an_error_without_the_X-XSRF-TOKEN_header_set
|
|
2170
|
+
-------------------------------------------------------------------------------------
|
|
2171
|
+
Processing by ApplicationController#create as HTML
|
|
2172
|
+
Can't verify CSRF token authenticity.
|
|
2173
|
+
Completed 422 Unprocessable Entity in 0ms (Allocations: 105)
|
|
2174
|
+
---------------------------------------------------------------
|
|
2175
|
+
AngularRailsCsrfTest: test_the_secure_flag_is_set_if_configured
|
|
2176
|
+
---------------------------------------------------------------
|
|
2177
|
+
Processing by ApplicationController#index as HTML
|
|
2178
|
+
Completed 200 OK in 0ms (Allocations: 104)
|
|
2179
|
+
--------------------------------------------------------------------------------------------------------
|
|
2180
|
+
AngularRailsCsrfTest: test_a_get_sets_the_XSRF-TOKEN_cookie_but_does_not_require_the_X-XSRF-TOKEN_header
|
|
2181
|
+
--------------------------------------------------------------------------------------------------------
|
|
2182
|
+
Processing by ApplicationController#index as HTML
|
|
2183
|
+
Completed 200 OK in 0ms (Allocations: 104)
|
|
2184
|
+
-------------------------------------------------------------
|
|
2185
|
+
AngularRailsCsrfTest: test_same_site_is_set_to_Lax_by_default
|
|
2186
|
+
-------------------------------------------------------------
|
|
2187
|
+
Processing by ApplicationController#index as HTML
|
|
2188
|
+
Completed 200 OK in 0ms (Allocations: 104)
|
|
2189
|
+
------------------------------------------------------------------------------------
|
|
2190
|
+
AngularRailsCsrfTest: test_secure_is_set_automatically_when_same_site_is_set_to_none
|
|
2191
|
+
------------------------------------------------------------------------------------
|
|
2192
|
+
Processing by ApplicationController#index as HTML
|
|
2193
|
+
Completed 200 OK in 0ms (Allocations: 104)
|
|
2194
|
+
-----------------------------------------------------------
|
|
2195
|
+
AngularRailsCsrfTest: test_a_custom_name_is_used_if_present
|
|
2196
|
+
-----------------------------------------------------------
|
|
2197
|
+
Processing by ApplicationController#index as HTML
|
|
2198
|
+
Completed 200 OK in 0ms (Allocations: 104)
|
|
2199
|
+
-----------------------------------------------------------------------------------------------------
|
|
2200
|
+
AngularRailsCsrfTest: test_a_post_raises_an_error_with_the_X-XSRF-TOKEN_header_set_to_the_wrong_value
|
|
2201
|
+
-----------------------------------------------------------------------------------------------------
|
|
2202
|
+
Processing by ApplicationController#create as HTML
|
|
2203
|
+
Can't verify CSRF token authenticity.
|
|
2204
|
+
Completed 422 Unprocessable Entity in 0ms (Allocations: 103)
|
|
2205
|
+
--------------------------------------------------------
|
|
2206
|
+
AngularRailsCsrfTest: test_the_domain_is_used_if_present
|
|
2207
|
+
--------------------------------------------------------
|
|
2208
|
+
Processing by ApplicationController#index as HTML
|
|
2209
|
+
Completed 200 OK in 0ms (Allocations: 115)
|
|
2210
|
+
-------------------------------------------------------------------------
|
|
2211
|
+
AngularRailsCsrfTest: test_csrf-cookie_is_not_set_if_exclusion_is_enabled
|
|
2212
|
+
-------------------------------------------------------------------------
|
|
2213
|
+
Processing by ApplicationController#index as HTML
|
|
2214
|
+
Completed 200 OK in 0ms (Allocations: 74)
|
|
2215
|
+
------------------------------------------------------
|
|
2216
|
+
AngularRailsCsrfTest: test_same_site_can_be_configured
|
|
2217
|
+
------------------------------------------------------
|
|
2218
|
+
Processing by ApplicationController#index as HTML
|
|
2219
|
+
Completed 200 OK in 0ms (Allocations: 104)
|
|
2220
|
+
----------------------------------------------------------------------------
|
|
2221
|
+
AngularRailsCsrfExceptionTest: test_a_get_does_not_set_the_XSRF-TOKEN_cookie
|
|
2222
|
+
----------------------------------------------------------------------------
|
|
2223
|
+
Processing by ExclusionsController#index as HTML
|
|
2224
|
+
Completed 200 OK in 0ms (Allocations: 71)
|
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: angular_rails_csrf
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 4.
|
|
4
|
+
version: 4.5.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- James Sanders
|
|
@@ -9,7 +9,7 @@ authors:
|
|
|
9
9
|
autorequire:
|
|
10
10
|
bindir: bin
|
|
11
11
|
cert_chain: []
|
|
12
|
-
date: 2020-
|
|
12
|
+
date: 2020-09-21 00:00:00.000000000 Z
|
|
13
13
|
dependencies:
|
|
14
14
|
- !ruby/object:Gem::Dependency
|
|
15
15
|
name: rake
|
|
@@ -45,14 +45,14 @@ dependencies:
|
|
|
45
45
|
requirements:
|
|
46
46
|
- - '='
|
|
47
47
|
- !ruby/object:Gem::Version
|
|
48
|
-
version: 6.0.3.
|
|
48
|
+
version: 6.0.3.3
|
|
49
49
|
type: :development
|
|
50
50
|
prerelease: false
|
|
51
51
|
version_requirements: !ruby/object:Gem::Requirement
|
|
52
52
|
requirements:
|
|
53
53
|
- - '='
|
|
54
54
|
- !ruby/object:Gem::Version
|
|
55
|
-
version: 6.0.3.
|
|
55
|
+
version: 6.0.3.3
|
|
56
56
|
- !ruby/object:Gem::Dependency
|
|
57
57
|
name: railties
|
|
58
58
|
requirement: !ruby/object:Gem::Requirement
|