authlogic 4.4.3 → 4.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2ddee07d72769ceaa9ba7e1cb47f8f4642df0ab981de7bac607f69796c9d0d6f
-  data.tar.gz: b1ee15e2637cf3379e6c24b1dda35abcf05527fb848c0d73ed25cf64633cf5fb
+  metadata.gz: 97762cbf5ee158d5a18ebe77bc96a542241f16b813ddda3ca80d2271dcbd0098
+  data.tar.gz: 5a0bbb0e964b0d71f436dbabb729f6da9dddc83d5c3fd5bdd33dc003cc15097f
 SHA512:
-  metadata.gz: e9f6bab4ddc5418fc74229a12912ef3411cf6252f8c9b22f88343ee9d8241bf7b3f4b82b159ea1375b1f69c107ebfb37cefb8503d8ba8971f9446994f21016dd
-  data.tar.gz: b8da5a086e0bb4b9047d16dda29877a2ddd5c791a2fa7998d1ffbd1d56dec04cb78026525070d008f05b7267e2a16c49810e688131c725b625499ecda53af0cf
+  metadata.gz: c4e860a5ca9a8ccd511f99d55a25ba3a17d800eec68e8c074c40a9b5c9f2a717d906c01660878bac030d72c4d058331e6230dfaa7145889202dd1b05a0d39ea8
+  data.tar.gz: 88319378fcb41fdec36a2d35bd1b35f34d5459eb2f52d94469cfe47faf7613d4f0a4974d659d40df9812656270c8c916018e5dfb941f0699f11e7a3bf0c5de13

data/CHANGELOG.md

@@ -5,17 +5,29 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
-## [5.0.0](https://github.com/binarylogic/authlogic/blob/5-0-stable/CHANGELOG.md)
+## 5.0.0
+
+See https://github.com/binarylogic/authlogic/blob/5-0-stable/CHANGELOG.md
+
+## Unreleased
 
 * Breaking Changes
-  * Drop AES256 crypto provider, deprecated in 4.2.0
-  * Drop support for transitioning from restful_authentication, deprecated in 4.1.0
-  * Uses `frozen_string_literal`, so assume all strings returned are frozen
+  * None
 * Added
   * None
 * Fixed
   * None
 
+## 4.5.0 (2020-03-23)
+
+* Breaking Changes
+  * None
+* Added
+  * [#701](https://github.com/binarylogic/authlogic/pull/701) - Ability to
+    specify None as a valid value to SameSite cookie attribute
+* Fixed
+  * None
+
 ## 4.4.3 (2019-03-23)
 
 * Breaking Changes

data/README.md

@@ -15,7 +15,7 @@ A clean, simple, and unobtrusive ruby authentication solution.
 | Version     | Documentation |
 | ----------- | ------------- |
 | Unreleased  | https://github.com/binarylogic/authlogic/blob/master/README.md |
-| 4.4.3       | https://github.com/binarylogic/authlogic/blob/v4.4.3/README.md |
+| 4.5.0       | https://github.com/binarylogic/authlogic/blob/v4.5.0/README.md |
 | 3.7.0       | https://github.com/binarylogic/authlogic/blob/v3.7.0/README.md |
 | 2.1.11      | https://github.com/binarylogic/authlogic/blob/v2.1.11/README.rdoc |
 | 1.4.3       | https://github.com/binarylogic/authlogic/blob/v1.4.3/README.rdoc |
@@ -382,6 +382,15 @@ class ApplicationController < ActionController::Base
 end
 ```
 
+### 2.e SameSite Cookie Attribute
+The SameSite attribute tells browsers when and how to fire cookies in first- or third-party situations. SameSite is used by a variety of browsers to identify whether or not to allow a cookie to be accessed.
+
+Up until recently, the standard default value when SameSite was not explicitly defined was to allow cookies in both first- and third-party contexts. However, starting with Chrome 80+, the SameSite attribute will not default to Lax behavior meaning cookies will only be permitted in first-party contexts. 
+
+Authlogic can allow you to explicitly set the value of SameSite to one of: Lax, Strict, or None. Note that when setting SameSite to None, the `secure` flag must also be set (secure is the default in Authlogic). 
+
+Reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#SameSite
+
 ## 3. Testing
 
 See [Authlogic::TestCase](https://github.com/binarylogic/authlogic/blob/master/lib/authlogic/test_case.rb)

data/lib/authlogic/session/cookies.rb

@@ -3,7 +3,7 @@ module Authlogic
     # Handles all authentication that deals with cookies, such as persisting,
     # saving, and destroying.
     module Cookies
-      VALID_SAME_SITE_VALUES = [nil, "Lax", "Strict"].freeze
+      VALID_SAME_SITE_VALUES = [nil, "Lax", "Strict", "None"].freeze
 
       def self.included(klass)
         klass.class_eval do

data/lib/authlogic/version.rb

@@ -16,6 +16,6 @@ module Authlogic
   #
   # @api public
   def self.gem_version
-    ::Gem::Version.new("4.4.3")
+    ::Gem::Version.new("4.5.0")
   end
 end

data/test/session_test/cookies_test.rb

@@ -76,6 +76,8 @@ module SessionTest
         assert_equal "Strict", session.same_site
         session.same_site = "Lax"
         assert_equal "Lax", session.same_site
+        session.same_site = "None"
+        assert_equal "None", session.same_site
 
         assert_raise(ArgumentError) { UserSession.same_site "foo" }
         assert_raise(ArgumentError) { UserSession.new.same_site "foo" }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: authlogic
 version: !ruby/object:Gem::Version
-  version: 4.4.3
+  version: 4.5.0
 platform: ruby
 authors:
 - Ben Johnson
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-03-24 00:00:00.000000000 Z
+date: 2020-03-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activerecord
@@ -326,8 +326,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.6
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: A clean, simple, and unobtrusive ruby authentication solution.