clerk-sdk-ruby 2.0.0 → 2.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 101f319b542b23eb2764f9b39179ad588093a0bd0fb2b8ca2a4efa38c3c4eb0d
-  data.tar.gz: 510741253965164102b7efb2e3877fd150c4ad447cb78966cf6d1e30196462d3
+  metadata.gz: e443f464076d7d267af214c5e2d12847aec0bf5bac6e80479736d02fbf92a8ae
+  data.tar.gz: a3b0457f1402594db56968d7af4e6dcc4674276f248083aad09f278530b22d57
 SHA512:
-  metadata.gz: 3cb5e38de99149778a0dfbb342a4b835fba0b1c29c2a44648ad0403d75160cbe23b384c15078623f6ff2d07a851a90516826ca6a8cdc583fe29cdc1d56b3c845
-  data.tar.gz: 6dfc4009ec233845bf92b9a08be14a4e2f8ec3374ef0ffa717cf668e4479fdc4ae838e3797a6721eb1a328acacd27c3f538f477dec68f772da3ca074b14d17ff
+  metadata.gz: dfb091cbe8eb5a88881db5294927eb849d20e8f802a6cac697f8c865328a5a29afe69e3467eb1c8aea74265f96ce8d4ca0d93d1533513c0c6f6aad1e32537463
+  data.tar.gz: 66e0af91ac94339b1b10f4507b936b9c38083cd1f5a9deb69cccfd8177e44c08f65d838e9bc00e8c543ac9396fffa19da7243eeb271ae203c3d2856ee3c5ba5f

data/lib/clerk/rack_middleware_v2.rb

@@ -66,7 +66,8 @@ module Clerk
       @env = env
       @req = Rack::Request.new(env)
       @env["clerk"] = ProxyV2.new
-      @header_token = @req.env["HTTP_AUTHORIZATION"]&.strip
+      @header_token = @req.env["HTTP_AUTHORIZATION"]
+      @header_token = @header_token.strip.sub(/\ABearer /, '') if @header_token
       @cookie_token = @req.cookies["__session"]
       @client_uat = @req.cookies["__client_uat"]
 
@@ -147,8 +148,21 @@ module Clerk
     end
 
     def cross_origin_request?(req)
+      # origin contains scheme+host and optionally port (ommitted if 80 or 443)
+      # ref. https://www.rfc-editor.org/rfc/rfc6454#section-6.1
       origin = req.env["HTTP_ORIGIN"]
-      origin && origin != req.host
+      return false if origin.nil?
+
+      # strip scheme
+      origin = origin.strip.sub(/\A(\w+:)?\/\//, '')
+      return false if origin.empty?
+
+      # Rack's host and port helpers are reverse-proxy-aware; that
+      # is, they prefer the de-facto X-Forwarded-* headers if they're set
+      request_host = req.host
+      request_host << ":#{req.port}" if req.port != 80 && req.port != 443
+
+      origin != request_host
     end
 
     def verify_token(token)

data/lib/clerk/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Clerk
-  VERSION = "2.0.0"
+  VERSION = "2.0.4"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: clerk-sdk-ruby
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.0.4
 platform: ruby
 authors:
 - Clerk
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2021-10-21 00:00:00.000000000 Z
+date: 2021-10-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday