challah 0.5.1 → 0.5.2

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## Challah 0.5.2
+
+* Created `SimpleCookieStore` and use it as the default storage method for Session. This varies from `CookieStore` only because the user agent and remote IP address are not used in the cookie.
+
 ## Challah 0.5.1
 
 * Dependency updates for Shoulda 3.0 and Rails 3.2.2.

data/README.md

@@ -199,10 +199,6 @@ If you'd prefer to set up your own login/logout actions, you can skip the inclus
 
 Documentation is available at: [http://rubydoc.info/gems/challah](http://rubydoc.info/gems/challah/frames)
 
-## Contributing to Challah 
-
-Contributions and pull requests are welcome.
-
 ### Issues
 
 If you have any issues or find bugs running Challah, please [report them on Github](https://github.com/jdtornow/challah/issues). While most functions should be stable, Challah is still in its infancy and certain issues may be present.

data/lib/challah/cookie_store.rb

@@ -1,124 +1,22 @@
 module Challah
-  # A base class for storing session data in a browser cookie.
+  # Store session data in a cookie, but use the user's user_agent and ip address
+  # in the cookie verification, for additional security.
+  #
+  # This method will force the user to log in slightly more often, as user agents
+  # and IP addresses change.
   # 
   # To use a different storage method for persisting a session, just create
   # a new class that responds to +read+, +save+ and +destroy+
-  class CookieStore    
-    def initialize(session)
-      @session = session
-    end
-    
-    def destroy
-      clear
-    end
-    
+  #
+  class CookieStore < SimpleCookieStore
     def inspect
       "#<CookieStore:0x#{object_id.to_s(16)} valid=#{existing?}>"
     end
     
-    def read
-      existing? ? cookie_values : nil
-    end
-    
-    def save(token, user_id)
-      @token = token
-      @user_id = user_id
-      
-      write_cookies!
-    end
-    
-    private
-      def clear
-        cookies.delete(session_cookie_name, :domain => domain)
-        cookies.delete(validation_cookie_name, :domain => domain)
-      end
-      
-      def cookie_values
-        session_cookie && session_cookie.to_s.split(joiner)
-      end
-      
-      def cookies
-        request.cookie_jar
-      end
-      
-      def domain
-        request.session_options[:domain]
-      end
-      
-      # Do the cookies exist, and are they valid?
-      def existing?
-        exists = false
-        
-        if session_cookie and validation_cookie
-          session_tmp = session_cookie.to_s
-          validation_tmp = validation_cookie.to_s
-          
-          if validation_tmp == validation_cookie_value(session_tmp)
-            exists = true
-          end
-        end
-        
-        exists
-      end
-      
-      def expiration
-        @expiration ||= 1.month.from_now
-      end
-      
-      def joiner
-        '@'
-      end
-      
-      def prefix
-        @prefix ||= Challah.options[:cookie_prefix]
-      end
-      
-      def request
-        raise "No Request Provided" unless @session and @session.request        
-        @session.request
-      end
-      
-      def session_cookie
-        cookies[session_cookie_name]
-      end
-    
-      def session_cookie_name
-        "#{prefix}-s"
-      end
-      
-      def session_cookie_value
-        "#@token#{joiner}#@user_id"
-      end
-      
-      def validation_cookie
-        cookies[validation_cookie_name]
-      end
-      
-      def validation_cookie_name
-        "#{prefix}-v"
-      end
-      
+    protected
       def validation_cookie_value(value = nil)
         value = session_cookie_value unless value
         Encrypter.md5(value, request.user_agent, request.remote_ip)
       end
-      
-      def write_cookies!
-        cookies[session_cookie_name] = {
-          :value => session_cookie_value,
-          :expires => expiration,
-          :secure => false,
-          :httponly => true,
-          :domain => domain
-        }
-        
-        cookies[validation_cookie_name] = {
-          :value => validation_cookie_value,
-          :expires => expiration,
-          :secure => false,
-          :httponly => true,
-          :domain => domain
-        }
-      end
   end
 end

data/lib/challah/simple_cookie_store.rb

@@ -0,0 +1,124 @@
+module Challah
+  # A base class for storing session data in a browser cookie.
+  # 
+  # To use a different storage method for persisting a session, just create
+  # a new class that responds to +read+, +save+ and +destroy+
+  class SimpleCookieStore    
+    def initialize(session)
+      @session = session
+    end
+    
+    def destroy
+      clear
+    end
+    
+    def inspect
+      "#<SimpleCookieStore:0x#{object_id.to_s(16)} valid=#{existing?}>"
+    end
+    
+    def read
+      existing? ? cookie_values : nil
+    end
+    
+    def save(token, user_id)
+      @token = token
+      @user_id = user_id
+      
+      write_cookies!
+    end
+    
+    private
+      def clear
+        cookies.delete(session_cookie_name, :domain => domain)
+        cookies.delete(validation_cookie_name, :domain => domain)
+      end
+      
+      def cookie_values
+        session_cookie && session_cookie.to_s.split(joiner)
+      end
+      
+      def cookies
+        request.cookie_jar
+      end
+      
+      def domain
+        request.session_options[:domain]
+      end
+      
+      # Do the cookies exist, and are they valid?
+      def existing?
+        exists = false
+        
+        if session_cookie and validation_cookie
+          session_tmp = session_cookie.to_s
+          validation_tmp = validation_cookie.to_s
+          
+          if validation_tmp == validation_cookie_value(session_tmp)
+            exists = true
+          end
+        end
+        
+        exists
+      end
+      
+      def expiration
+        @expiration ||= 1.month.from_now
+      end
+      
+      def joiner
+        '@'
+      end
+      
+      def prefix
+        @prefix ||= Challah.options[:cookie_prefix]
+      end
+      
+      def request
+        raise "No Request Provided" unless @session and @session.request        
+        @session.request
+      end
+      
+      def session_cookie
+        cookies[session_cookie_name]
+      end
+    
+      def session_cookie_name
+        "#{prefix}-s"
+      end
+      
+      def session_cookie_value
+        "#@token#{joiner}#@user_id"
+      end
+      
+      def validation_cookie
+        cookies[validation_cookie_name]
+      end
+      
+      def validation_cookie_name
+        "#{prefix}-v"
+      end
+      
+      def validation_cookie_value(value = nil)
+        value = session_cookie_value unless value
+        Encrypter.md5(value)
+      end
+      
+      def write_cookies!
+        cookies[session_cookie_name] = {
+          :value => session_cookie_value,
+          :expires => expiration,
+          :secure => false,
+          :httponly => true,
+          :domain => domain
+        }
+        
+        cookies[validation_cookie_name] = {
+          :value => validation_cookie_value,
+          :expires => expiration,
+          :secure => false,
+          :httponly => true,
+          :domain => domain
+        }
+      end
+  end
+end

data/lib/challah/version.rb

@@ -1,3 +1,3 @@
 module Challah
-  VERSION = "0.5.1" unless defined?(::Challah::VERSION)
+  VERSION = "0.5.2" unless defined?(::Challah::VERSION)
 end

data/lib/challah.rb

@@ -4,8 +4,11 @@ require 'challah/authable/permission_role'
 require 'challah/authable/permission_user'
 require 'challah/authable/role'
 require 'challah/authable/user'
-require 'challah/controller'
+
+require 'challah/simple_cookie_store'
 require 'challah/cookie_store'
+
+require 'challah/controller'
 require 'challah/encrypter'
 require 'challah/random'
 require 'challah/session'
@@ -29,7 +32,7 @@ module Challah
       extend AuthablePermissionRole
       extend AuthablePermissionUser
       extend AuthableRole
-      extend AuthableUser      
+      extend AuthableUser
     end
   end
   
@@ -37,12 +40,11 @@ module Challah
     # @private
     class ::ActionController::Base
       include Controller
-      
       helper_method :logged_in?, :current_user, :current_user_session, :current_user?, :has
     end
   end
   
-  # Configuration options  
+  # Configuration options
   class << self
     # Get or set options for the current Challah instance. In most cases these should be
     # changed within a config/initializers/ file in your app.
@@ -50,13 +52,13 @@ module Challah
     # @param [Hash] options The options to get or set
     # @option options [String] :cookie_prefix ('challah') A prefix to put in the names of the cookies that will be set.
     # @option options [String] :access_denied_view ('challah/sessions/access_denied')Relative path to the view that will be used to show access denied method.
-    # @option options [Class] :storage_class (CookieStore) The class to use for persistence of sessions.
+    # @option options [Class] :storage_class (SimpleCookieStore) The class to use for persistence of sessions.
     def options
       @options ||= {
         :api_key_enabled => false,
         :cookie_prefix => 'challah',
         :access_denied_view => 'sessions/access_denied',
-        :storage_class => CookieStore,
+        :storage_class => SimpleCookieStore,
         :skip_routes => false
       }
     end

data/test/simple_cookie_store_test.rb

@@ -0,0 +1,97 @@
+require 'helper'
+
+class SimpleCookieStoreTest < ActiveSupport::TestCase
+  include Challah
+  
+  context "The SimpleCookieStore class" do
+    setup do
+      @user = Factory(:user)
+      @request = MockRequest.new
+    end
+    
+    should "save session in a request cookie store" do
+      assert_equal [], @request.cookies.keys
+      
+      session = Session.new(@request)
+      session.store = SimpleCookieStore.new(session)
+      session.persist = true
+      session.user = @user
+      session.save
+            
+      assert_equal %w( challah-s challah-v ), @request.cookies.keys.sort
+      assert_equal "#{@user.persistence_token}@#{@user.id}", @request.cookies['challah-s'][:value]
+      assert_equal "test.dev", @request.cookies['challah-s'][:domain]
+      
+      assert_equal Encrypter.md5("#{@user.persistence_token}@#{@user.id}"), @request.cookies['challah-v'][:value]
+      assert_equal "test.dev", @request.cookies['challah-v'][:domain]
+    end
+    
+    should "be able to inspect the store" do
+      session = Session.new(@request)
+      session.store = SimpleCookieStore.new(session)
+      session.persist = true
+      session.user = @user
+      session.save
+      
+      assert session.store.inspect =~ /<SimpleCookieStore:(.*?)>/, 'Does not match'
+    end 
+    
+    should "read cookies and detect tampered verification cookies" do
+      assert_equal [], @request.cookies.keys
+      
+      session = Session.new(@request)
+      session.store = SimpleCookieStore.new(session)
+      session.persist = true
+      session.user = @user
+      session.save
+      
+      validation_cookie_val = Encrypter.md5("#{@user.persistence_token}@#{@user.id}")
+      session_cookie_val = "#{@user.persistence_token}@#{@user.id}"
+      
+      assert_equal session_cookie_val, @request.cookies['challah-s'][:value]
+      assert_equal session_cookie_val, session.store.send(:session_cookie)[:value]
+      assert_equal validation_cookie_val, @request.cookies['challah-v'][:value]
+      assert_equal validation_cookie_val, session.store.send(:validation_cookie)[:value]
+      
+      session.store.stubs(:validation_cookie).returns(validation_cookie_val)
+      session.store.stubs(:session_cookie).returns(session_cookie_val)
+      
+      session2 = Session.new(@request)
+      session2.persist = true
+      session2.store = session.store      
+      session2.read
+      
+      assert_equal true, session2.store.send(:existing?)
+      assert_equal true, session2.valid?
+      assert_equal @user.id, session2.user_id
+      
+      session.store.stubs(:validation_cookie).returns('bad-value')
+      
+      session3 = Session.new(@request)
+      session3.store = session.store
+      session3.read
+      
+      assert_equal false, session3.store.send(:existing?)
+      assert_equal false, session3.valid?
+    end
+    
+    should "delete sessions from cookies" do
+      session = Session.new(@request)
+      session.store = SimpleCookieStore.new(session)
+      session.user = @user
+      session.persist = true
+      
+      session.save
+      
+      assert_equal true, session.valid?
+      assert_equal @user, session.user
+      assert_equal %w( challah-s challah-v ), @request.cookies.keys.sort
+      
+      session.destroy
+      
+      assert_equal false, session.valid?
+      assert_equal nil, session.user
+      assert_equal [], @request.cookies.keys.sort
+    end
+  end
+end