clearance 2.3.1 → 2.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 73e524b6026ced3c81ba4f5755fcc40190b5ca08e058d4297780600dc09dfa9a
-  data.tar.gz: 5c8fe49a083f5bddf070ed33eed1c78b5154d5da2c4f6bb3b52f5709c3db7875
+  metadata.gz: bf42dbdfbd60820a6690813fef30b305ffa76ca93852ad6183ce499d1fa51413
+  data.tar.gz: 9832b513dcc54672a809b326334d0967266113027d35f4a57add919a7f222201
 SHA512:
-  metadata.gz: b8f2689813bcd73ed5d8cd9f5783f3659dbf001f924af4c595c2a5470ad5d1b9d9f57126117626204f0cec9e13b989d757e4baa33e077bc7b6cfde394d6a2f3d
-  data.tar.gz: ac38abe61a29243c8e253954accad74c8ada5532876b53483ce4991b745124c265674a6df908814a78b3ef4d467e8abd27e9355332e9162bfd25865f8b7bea2b
+  metadata.gz: 6a4921201ae474f99af273a1cf524e63a76e868b4470bcf8972ea4ed368bfdd62ae7597c8a8d9b9bffe08803b62d2725fa49737b6b66319eb8b877719bf26d45
+  data.tar.gz: 9f38b6e9870112874cabe5c4402bd22984d90713d2ac2b18b157893ba7787777783452528948877e5bcf3bfe5549abce78f8e0f85877f1661a1ea11adb66248f

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    clearance (2.3.1)
+    clearance (2.4.0)
       actionmailer (>= 5.0)
       activemodel (>= 5.0)
       activerecord (>= 5.0)

data/NEWS.md

@@ -3,6 +3,14 @@
 The noteworthy changes for each Clearance version are included here. For a
 complete changelog, see the git history for each version via the version links.
 
+## [2.4.0] - March 5, 2021
+
+### Added
+
+- Optionally use signed cookies to prevent remember token timing attacks
+
+[2.4.0]: https://github.com/thoughtbot/clearance/compare/v2.3.1...v2.4.0
+
 ## [2.3.1] - March 5, 2021
 
 ### Fixed
@@ -13,6 +21,8 @@ complete changelog, see the git history for each version via the version links.
 - Revert case sensitivity for email uniqueness
 - Bump nokogiri and actionview dependencies to address security vulnerabilities
 
+[2.3.1]: https://github.com/thoughtbot/clearance/compare/v2.3.0...v2.3.1
+
 ## [2.3.0] - August 14, 2020
 
 ### Fixed

data/README.md

@@ -62,6 +62,7 @@ Clearance.configure do |config|
   config.rotate_csrf_on_sign_in = true
   config.same_site = nil
   config.secure_cookie = false
+  config.signed_cookie = false
   config.sign_in_guards = []
   config.user_model = "User"
   config.parent_controller = "ApplicationController"
@@ -286,6 +287,33 @@ and `password` attributes. Over-riding the `email_optional?` or
 `skip_password_validation?` methods to return `true` will disable those
 validations from being added.
 
+### Signed Cookies
+
+By default, Clearance uses unsigned cookies. If you would like to use signed
+cookies you can do so by overriding the default in an initializer like so:
+
+```ruby
+Clearance.configure do |config|
+  # ... other overrides
+  config.signed_cookie = true
+end
+```
+
+If you are currently not using unsigned cookies but would like to migrate your
+users over to them without breaking current sessions, you can do so by passing
+in `:migrate` rather than `true` as so:
+
+```ruby
+Clearance.configure do |config|
+  # ... other overrides
+  config.signed_cookie = :migrate
+end
+```
+
+You can read more about signed cookies in Clearance and why they are a good idea
+in the [pull request that added them](https://github.com/thoughtbot/clearance/pull/917).
+
+
 ## Extending Sign In
 
 By default, Clearance will sign in any user with valid credentials. If you need

data/lib/clearance/version.rb

@@ -1,3 +1,3 @@
 module Clearance
-  VERSION = "2.3.1".freeze
+  VERSION = "2.4.0".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: clearance
 version: !ruby/object:Gem::Version
-  version: 2.3.1
+  version: 2.4.0
 platform: ruby
 authors:
 - Dan Croak
@@ -22,10 +22,10 @@ authors:
 - Jason Morrison
 - Galen Frechette
 - Josh Steiner
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-03-05 00:00:00.000000000 Z
+date: 2021-04-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bcrypt
@@ -295,7 +295,7 @@ homepage: https://github.com/thoughtbot/clearance
 licenses:
 - MIT
 metadata: {}
-post_install_message:
+post_install_message: 
 rdoc_options:
 - "--charset=UTF-8"
 require_paths:
@@ -312,7 +312,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubygems_version: 3.1.2
-signing_key:
+signing_key: 
 specification_version: 4
 summary: Rails authentication & authorization with email & password.
 test_files: []