cuba-csrf 0.0.2 → 0.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 94e98c48283db2c21543133020a4c7e1bb6a13d1
-  data.tar.gz: 412e34ab4a7759974478bfb6fdc24de8a09f44ff
+  metadata.gz: e90068b1138f718ffb414569573232216f4a5f87
+  data.tar.gz: aa11d64ba6805e470a61650b7cf0165c49235a26
 SHA512:
-  metadata.gz: 6cc9730a59a1f11814b6cc035f988402919af9339cf597c6c54c08eb9bd5f3ee7908b67bb4fdbb6be91dba03662d2adf10aa3f208aa306eccd7595ac9b33ccb3
-  data.tar.gz: 139fde650e30b59734b81ee0f925c202806919b1de39ed0cf242797ddebe78d242cbe155a0be3941040b08260aabcae38c8dd1d90e4739929ab6318256438716
+  metadata.gz: cf0209f12ee25accc870ad7e8fb05830e9d46d7c65d7755851154f7d5930ef079cf31f4c75b558646cc108e9250d7051d2215b0dbf02ba678450c08079526bac
+  data.tar.gz: 85537a9e17c131a9afa899d8dd7b1d65f02c30e157f02cc63e6ae7f5a1a74f43dd2b35500de439aee0f3d9e1672371dac5a63e35640697e23bfbe2625b6d30a5

data/LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2015-Present Francesco Rodríguez, Mayn Kjær
+Copyright (c) 2015-Present Harmoni LLC
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

data/README.md

@@ -31,7 +31,7 @@ require "cuba/csrf"
 Cuba.plugin(Cuba::CSRF)
 
 Cuba.define do
-  unless csrf_safe?
+  on !csrf_safe? do
     session.clear
 
     res.status = 403
@@ -64,9 +64,22 @@ HTTP compression or randomize secrets per request.
 If it's possible, disable HTTP compression. In Nginx, you can use
 the `gzip off` directive.
 
-This plugin doesn't generate or mask CSRF tokens per request. This means
-that if you plan to use HTTP compression, your application might be vulnerable
-to BREACH.
+By default, this plugin doesn't generate or mask CSRF tokens per request.
+This means that if you plan to use HTTP compression, your application might
+be vulnerable to BREACH. However, generation of new secrets per request
+can be done with:
+
+```ruby
+Cuba.define do
+  on !csrf_safe? do
+    ...
+  end
+
+  session.delete(:csrf_token)
+
+  ...
+end
+```
 
 We designed this library to fit our use case. We don't have HTTP compression
 enabled because we also have other sensitive information apart from the CSRF

data/cuba-csrf.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name = "cuba-csrf"
-  s.version = "0.0.2"
+  s.version = "0.0.3"
   s.summary = "CSRF protection for Cuba applications."
   s.description = s.summary
   s.authors = ["Francesco Rodríguez", "Mayn Kjær"]

data/lib/cuba/csrf.rb

@@ -3,14 +3,21 @@ require "securerandom"
 
 module Cuba::CSRF
   def csrf_safe?
-    req.get? || req.head? || req[:csrf_token] == csrf_token
+    req.get? || req.head? ||
+      req[:csrf_token] == csrf_token ||
+      env["HTTP_X_CSRF_TOKEN"] == csrf_token
   end
 
   def csrf_token
     session[:csrf_token] ||= SecureRandom.base64(32)
   end
 
-  def csrf_tag
+  def csrf_form_tag
     %Q(<input type="hidden" name="csrf_token" value="#{csrf_token}">)
   end
+  alias :csrf_tag :csrf_form_tag
+
+  def csrf_meta_tag
+    %Q(<meta name="csrf_token" content="#{csrf_token}">)
+  end
 end

data/makefile

@@ -2,7 +2,7 @@ DEFAULT_GOAL := test
 .PHONY: test
 
 gem:
-	gem build cuba-csrf.gemspec
+	gem build *.gemspec
 
 test:
 	cutest test/*.rb

data/test/csrf.rb

@@ -69,6 +69,17 @@ scope do
     end
   end
 
+  test "http header" do
+    csrf_token = SecureRandom.hex(32)
+
+    Cuba.define do
+      session[:csrf_token] = csrf_token
+      raise unless csrf_safe?
+    end
+
+    post "/", {}, { "HTTP_X_CSRF_TOKEN" => csrf_token }
+  end
+
   test "sub app raises too" do
     class App < Cuba
       define do
@@ -131,8 +142,12 @@ scope do
     end
 
     api = Api.new
-    csrf_tag = %Q(<input type="hidden" name="csrf_token" value="#{api.csrf_token}">)
 
-    assert_equal(csrf_tag, api.csrf_tag)
+    csrf_form_tag = %Q(<input type="hidden" name="csrf_token" value="#{api.csrf_token}">)
+    csrf_meta_tag = %Q(<meta name="csrf_token" content="#{api.csrf_token}">)
+
+    assert_equal(csrf_form_tag, api.csrf_tag)
+    assert_equal(csrf_form_tag, api.csrf_form_tag)
+    assert_equal(csrf_meta_tag, api.csrf_meta_tag)
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cuba-csrf
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 0.0.3
 platform: ruby
 authors:
 - Francesco Rodríguez
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-01-13 00:00:00.000000000 Z
+date: 2015-02-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: cuba