enhanced_request_forgery_protection 0.9.0

data/.document

@@ -0,0 +1,5 @@
+lib/**/*.rb
+bin/*
+- 
+features/**/*.feature
+LICENSE.txt

data/.rspec

@@ -0,0 +1 @@
+--color

data/Gemfile

@@ -0,0 +1,19 @@
+source "http://rubygems.org"
+gem "actionpack", "~> 3.0.7"
+gem "activesupport", "~> 3.0.7"
+
+# Add dependencies required to use your gem here.
+# Example:
+#   gem "activesupport", ">= 2.3.5"
+
+# Add dependencies to develop your gem here.
+# Include everything needed to run rake, tests, features, etc.
+group :development do
+  gem "rspec", "~> 2.6.0"
+  gem "cucumber", ">= 0"
+  gem "bundler", "~> 1.0.0"
+  gem "jeweler", "~> 1.5.2"
+  gem "rcov", ">= 0"
+  gem "ruby-debug", :platform => :ruby_18
+  gem "ruby-debug19", :require => "ruby-debug", :platform => :ruby_19
+end

data/Gemfile.lock

@@ -0,0 +1,89 @@
+GEM
+  remote: http://rubygems.org/
+  specs:
+    abstract (1.0.0)
+    actionpack (3.0.7)
+      activemodel (= 3.0.7)
+      activesupport (= 3.0.7)
+      builder (~> 2.1.2)
+      erubis (~> 2.6.6)
+      i18n (~> 0.5.0)
+      rack (~> 1.2.1)
+      rack-mount (~> 0.6.14)
+      rack-test (~> 0.5.7)
+      tzinfo (~> 0.3.23)
+    activemodel (3.0.7)
+      activesupport (= 3.0.7)
+      builder (~> 2.1.2)
+      i18n (~> 0.5.0)
+    activesupport (3.0.7)
+    archive-tar-minitar (0.5.2)
+    builder (2.1.2)
+    columnize (0.3.2)
+    cucumber (0.10.0)
+      builder (>= 2.1.2)
+      diff-lcs (~> 1.1.2)
+      gherkin (~> 2.3.2)
+      json (~> 1.4.6)
+      term-ansicolor (~> 1.0.5)
+    diff-lcs (1.1.2)
+    erubis (2.6.6)
+      abstract (>= 1.0.0)
+    gherkin (2.3.3)
+      json (~> 1.4.6)
+    git (1.2.5)
+    i18n (0.5.0)
+    jeweler (1.5.2)
+      bundler (~> 1.0.0)
+      git (>= 1.2.5)
+      rake
+    json (1.4.6)
+    linecache (0.43)
+    linecache19 (0.5.12)
+      ruby_core_source (>= 0.1.4)
+    rack (1.2.2)
+    rack-mount (0.6.14)
+      rack (>= 1.0.0)
+    rack-test (0.5.7)
+      rack (>= 1.0)
+    rake (0.8.7)
+    rcov (0.9.9)
+    rspec (2.6.0)
+      rspec-core (~> 2.6.0)
+      rspec-expectations (~> 2.6.0)
+      rspec-mocks (~> 2.6.0)
+    rspec-core (2.6.3)
+    rspec-expectations (2.6.0)
+      diff-lcs (~> 1.1.2)
+    rspec-mocks (2.6.0)
+    ruby-debug (0.10.4)
+      columnize (>= 0.1)
+      ruby-debug-base (~> 0.10.4.0)
+    ruby-debug-base (0.10.4)
+      linecache (>= 0.3)
+    ruby-debug-base19 (0.11.25)
+      columnize (>= 0.3.1)
+      linecache19 (>= 0.5.11)
+      ruby_core_source (>= 0.1.4)
+    ruby-debug19 (0.11.6)
+      columnize (>= 0.3.1)
+      linecache19 (>= 0.5.11)
+      ruby-debug-base19 (>= 0.11.19)
+    ruby_core_source (0.1.5)
+      archive-tar-minitar (>= 0.5.2)
+    term-ansicolor (1.0.5)
+    tzinfo (0.3.26)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  actionpack (~> 3.0.7)
+  activesupport (~> 3.0.7)
+  bundler (~> 1.0.0)
+  cucumber
+  jeweler (~> 1.5.2)
+  rcov
+  rspec (~> 2.6.0)
+  ruby-debug
+  ruby-debug19

data/LICENSE.txt

@@ -0,0 +1,22 @@
+EnhancedRequestForgeryProtection, a Ruby on Rails plugin to enhance Rails' build in protection against Cross-Site Request Forgery
+
+Copyright (C) 2007 Bart Teeuwisse <bart [dot] teeuwisse [at] thecodemill.biz>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.rdoc

@@ -0,0 +1,46 @@
+= EnhancedRequestForgeryProtection
+
+A plugin to protect against Cross-Site Request Forgery. From
+http://en.wikipedia.org/wiki/Crsf:
+
+<i>Cross-site request forgery, also known as one click attack or session
+riding and abbreviated as CSRF (Sea-Surf) or XSRF, is a kind of
+malicious exploit of websites. Although this type of attack has
+similarities to cross-site scripting (XSS), cross-site scripting
+requires the attacker to inject unauthorized code into a website,
+while cross-site request forgery merely transmits unauthorized
+commands from a user the website trusts.</i>
+
+== Prevention
+
+For the web site, switching from a persistent authentication method
+(e.g. a cookie or HTTP authentication) to a transient authentication
+method (e.g. a hidden field provided on every form) will help prevent
+these attacks. Use RequestForgeryProtection to include a secret,
+user-specific token in forms that is verified in addition to the cookie.
+
+EnhancedRequestForgeryProtection extends Rails' RequestForgeryProtection with scopes and time windows. By default
+authentication tokens are scoped to the controller, but can be arbitrarily defined. The default time window is 1 hour.
+Form submissions that come in outside the time window will be rejected. Scopes and time windows are useful when you
+want to protect certain areas more tightly then others. For example you might want to use a 15 minute time window for
+all actions that modify the user's account.
+
+Requests that fail authentication are redirected back to the referring URL. Typically this will be the page where the form
+originated. The user will receive a new authentication token and can resubmit the form. If it is no referring URL then
+the response will be Unprocessable Entity (HTTP code 422) just like the stock RequestForgeryProtection.
+
+== Contributing to EnhancedRequestForgeryProtection
+
+* Check out the latest master to make sure the feature hasn't been implemented or the bug hasn't been fixed yet
+* Check out the issue tracker to make sure someone already hasn't requested it and/or contributed it
+* Fork the project
+* Start a feature/bugfix branch
+* Commit and push until you are happy with your contribution
+* Make sure to add tests for it. This is important so I don't break it in a future version unintentionally.
+* Please try not to mess with the Rakefile, version, or history. If you want to have your own version, or is otherwise necessary, that is fine, but please isolate to its own commit so I can cherry-pick around it.
+
+== Copyright
+
+Copyright (c) 2007 Bart Teeuwisse. See LICENSE.txt for
+further details.
+

data/Rakefile

@@ -0,0 +1,55 @@
+require 'rubygems'
+require 'bundler'
+begin
+  Bundler.setup(:default, :development)
+rescue Bundler::BundlerError => e
+  $stderr.puts e.message
+  $stderr.puts "Run `bundle install` to install missing gems"
+  exit e.status_code
+end
+require 'rake'
+
+require 'jeweler'
+Jeweler::Tasks.new do |gem|
+  # gem is a Gem::Specification... see http://docs.rubygems.org/read/chapter/20 for more options
+  gem.name = "enhanced_request_forgery_protection"
+  gem.homepage = "http://github.com/bartt/enhanced_request_forgery_protection"
+  gem.license = "MIT"
+  gem.summary = "A Rails plugin to enhance Rails's basic protect against Cross-Site Request Forgery with scopes and time windows."
+  gem.description = "Add scopes and time windows to Rails's CSRF protection. Redirect to referrer with a flash message when possible."
+  gem.email = "bart.teeuwisse@thecodemill.biz"
+  gem.authors = ["Bart Teeuwisse"]
+  # Include your dependencies below. Runtime dependencies are required when using your gem,
+  # and development dependencies are only needed for development (ie running rake tasks, tests, etc)
+  #  gem.add_runtime_dependency 'jabber4r', '> 0.1'
+  #  gem.add_development_dependency 'rspec', '> 1.2.3'
+end
+Jeweler::RubygemsDotOrgTasks.new
+
+require 'rspec/core'
+require 'rspec/core/rake_task'
+RSpec::Core::RakeTask.new(:spec) do |spec|
+  spec.pattern = FileList['spec/**/*_spec.rb']
+end
+
+RSpec::Core::RakeTask.new(:rcov) do |spec|
+  spec.pattern = 'spec/**/*_spec.rb'
+  spec.rcov = true
+end
+
+require 'cucumber/rake/task'
+Cucumber::Rake::Task.new(:features)
+
+task :default => :spec
+
+require 'rake/rdoctask'
+desc 'Generate documentation for the enhanced_request_forgery_protection plugin.'
+Rake::RDocTask.new do |rdoc|
+  version = File.exist?('VERSION') ? File.read('VERSION') : ""
+
+  rdoc.rdoc_dir = 'rdoc'
+  rdoc.title = "enhanced_request_forgery_protection #{version}"
+  rdoc.options << '--line-numbers' << '--inline-source'
+  rdoc.rdoc_files.include('README*')
+  rdoc.rdoc_files.include('lib/**/*.rb')
+end

data/VERSION

@@ -0,0 +1 @@
+0.9.0

data/features/enhanced_request_forgery_protection.feature

@@ -0,0 +1,9 @@
+Feature: something something
+  In order to something something
+  A user something something
+  something something something
+
+  Scenario: something something
+    Given inspiration
+    When I create a sweet new gem
+    Then everyone should see how awesome I am

data/features/support/env.rb

@@ -0,0 +1,13 @@
+require 'bundler'
+begin
+  Bundler.setup(:default, :development)
+rescue Bundler::BundlerError => e
+  $stderr.puts e.message
+  $stderr.puts "Run `bundle install` to install missing gems"
+  exit e.status_code
+end
+
+$LOAD_PATH.unshift(File.dirname(__FILE__) + '/../../lib')
+require 'enhanced_request_forgery_protection'
+
+require 'rspec/expectations'

data/install.rb

@@ -0,0 +1 @@
+# Install hook code here

data/lib/enhanced_request_forgery_protection.rb

@@ -0,0 +1,159 @@
+require 'openssl'
+
+# A plugin to protect against {Cross-Site Request Forgery}[http://en.wikipedia.org/wiki/Crsf].
+#
+# = Class variables
+#
+# Because authenticity_token verification is a request filter one can't pass
+# variables to a +verify_authenticity_token+. But because EnhancedRequestForgeryProtection gets mixed into
+# ActionController one can use class instance variables to pass
+# information to +verify_authenticity_token+ and +hexdigest+. EnhancedRequestForgeryProtection uses the
+# following attributes:
+#
+# <tt>authenticity_scope</tt>::
+#     The scope of actions that use compatible authenticity tokens. Defaults to
+#     <i>the ActionController's class name</i> which means that
+#     +verify_authenticity_token+ only validates actions of that controller.
+#     Override to broaden the scope.  Setting the scope in 2
+#     controllers to the same value makes their authenticity tokens compatible.
+# <tt>authenticity_window</tt>::
+#     The time window within which the form has to be submitted and
+#     verified. Defaults to <i>1 hour</i>.
+# <tt>authenticity_flash_timed_out_msg</tt>::
+#     The message to passed to the session flash if the authenticity
+#     token arrives outside the authenticity window. Defaults to
+#     <i>Form submission timed out. Please resubmit.</i>.
+# <tt>authenticity_flash_invalid_msg</tt>::
+#     The message to passed to the session flash if the authenticity_token doesn't
+#     validate. Defaults to: <i>Possible form data tampering. Please
+#     resubmit.</i>
+module EnhancedRequestForgeryProtection
+  extend ActiveSupport::Concern
+
+  include AbstractController::Helpers
+
+  included do
+    helper_method :form_authenticity_token
+  end
+
+  module ClassMethods #:nodoc:
+    def authenticity_scope
+      @authenticity_scope ||= self.name
+    end
+
+    def authenticity_window
+      @authenticity_window ||= 1.hour
+    end
+
+    def authenticity_timed_out_msg
+      @authenticity_timed_out_msg ||= 'Form submission timed out. Please resubmit.'
+    end
+
+    def authenticity_invalid_msg
+      @authenticity_invalid_msg ||= 'Possible form data tampering. Please resubmit.'
+    end
+  end
+
+  module InstanceMethods #:doc:
+    protected
+      # The actual before_filter that is used.  Modify this to change how you handle unverified requests.
+      def verify_authenticity_token
+        verified_request? || handle_unverified_request
+      end
+
+      def handle_unverified_request
+        if request.env['HTTP_REFERER']
+          redirect_to request.env['HTTP_REFERER']
+        else
+          reset_session
+        end
+      end
+
+      # Returns true or false if a request is verified.  Checks:
+      #
+      # * is it a GET request?  Gets should be safe and idempotent
+      # * Does the form_authenticity_token match the given token value from the params?
+      # * Does the X-CSRF-Token header match the form_authenticity_token
+      def verified_request?
+        return true if !protect_against_forgery? || request.get?
+        @token = params[request_forgery_protection_token]
+        @stamped_at, @digest = split_request_authenticity_token
+        if @digest == hexdigest
+          within_authenticity_window?
+        else
+          if request.headers['X-CSRF-Token']
+            @token = request.headers['X-CSRF-Token']
+            @stamped_at, @digest = split_request_authenticity_token
+            if @digest == hexdigest
+              within_authenticity_window?
+            else
+              log_authenticity_mismatch("Invalid X-CSRF-Token header")
+              flash[:warning] = self.class.authenticity_invalid_msg
+              false
+            end
+          else
+            log_authenticity_mismatch("Invalid #{request_forgery_protection_token}")
+            flash[:warning] = self.class.authenticity_invalid_msg
+            false
+          end
+        end
+      end
+
+      # Generates a timestamped authenticity token
+      def form_authenticity_token
+        @private_form_authenticity_token ||= begin
+          @stamped_at = timestamp
+          "#{@stamped_at}#{hexdigest}"
+        end
+      end
+
+      # Sets the token value for the current session.
+      def csrf_token
+        session[:_csrf_token] ||= ActiveSupport::SecureRandom.base64(32)
+      end
+
+      # Create a 10 digit timestamp for the current time
+      def timestamp
+        "%010d" % Time.now().to_i
+      end
+
+      # Create a hexadecimal digest of the request's remote IP address, the timestamp of the form authenticity token,
+      # the CSRF token and the class' authenticity scope
+      def hexdigest
+        OpenSSL::Digest::SHA1.hexdigest("#{request.remote_ip}#{@stamped_at}#{csrf_token}#{self.class.authenticity_scope}")
+      end
+
+      # Split the request's authenticity token into the 2 components it is made up from: the timestamp of the token and
+      # the hexadecimal digest.
+      def split_request_authenticity_token
+        @token.respond_to?(:[]) ? [@token[0..9], @token[10..-1]] : [nil, nil]
+      end
+
+      # Check if the request falls within the authenticity window of the class.
+      def within_authenticity_window?
+        if Time.at(@stamped_at.to_i) + self.class.authenticity_window > Time.now
+          true
+        else
+          log_authenticity_mismatch("Authenticity token outside time window")
+          # Replace the authenticity_invalid_msg if there was one.
+          flash[:warning] = self.class.authenticity_timed_out_msg
+          false
+        end
+      end
+
+      # Log details of a authenticity_token mismatch to the application log.
+      def log_authenticity_mismatch(msg)
+        logger.warn("#{msg}:
+    #{request_forgery_protection_token} = #{@token}
+    timestamp = #{@stamped_at}
+    remote_ip = #{request.remote_ip}
+    csrf_token = #{csrf_token}
+    scope = #{self.class.authenticity_scope}
+    hexdigest = #{hexdigest}")
+      end
+  end
+end
+
+if defined?(ActionController::RequestForgeryProtection)
+  ActionController::Base.send(:include, EnhancedRequestForgeryProtection)
+end

data/lib/tasks/enhanced_request_forgery_protection_tasks.rake

@@ -0,0 +1,4 @@
+# desc "Explaining what the task does"
+# task :enhanced_request_forgery_protection do
+#   # Task goes here
+# end

data/spec/controllers/enhanced_request_forgery_protection_spec.rb

@@ -0,0 +1,190 @@
+require File.expand_path(File.dirname(__FILE__) + '/../spec_helper')
+
+class ApplicationController < ActionController::Base
+end
+
+describe "EnhancedRequestForgeryProtection" do
+  describe "ClassMethods" do
+    it "should assign an anonimous class the correct defaults" do
+      klass = Class.new
+      klass.send(:include, EnhancedRequestForgeryProtection)
+      klass.authenticity_scope.to_s.should eq ""
+      klass.authenticity_window.should eq 1.hour
+      klass.authenticity_timed_out_msg.should eq 'Form submission timed out. Please resubmit.'
+      klass.authenticity_invalid_msg.should eq 'Possible form data tampering. Please resubmit.'
+    end
+
+    it "should assign a named class the correct defaults" do
+      class Klass
+        include EnhancedRequestForgeryProtection
+      end
+      Klass.authenticity_scope.should eq 'Klass'
+      Klass.authenticity_window.should eq 1.hour
+      Klass.authenticity_timed_out_msg.should eq 'Form submission timed out. Please resubmit.'
+      Klass.authenticity_invalid_msg.should eq 'Possible form data tampering. Please resubmit.'
+    end
+
+    it "should override defaults through class instance variables" do
+      klass = Class.new do
+        include EnhancedRequestForgeryProtection
+        @authenticity_scope = "my scope"
+        @authenticity_window = 1.day
+        @authenticity_timed_out_msg = "Slow poke!"
+        @authenticity_invalid_msg = "Invalid"
+      end
+      klass.authenticity_scope.should eq "my scope"
+      klass.authenticity_window.should eq 1.day
+      klass.authenticity_timed_out_msg.should eq 'Slow poke!'
+      klass.authenticity_invalid_msg.should eq 'Invalid'
+    end
+  end
+
+  describe "InstanceMethods" do
+    before :each do
+      class Object
+        remove_const :Klass
+      end
+      class Klass
+        include EnhancedRequestForgeryProtection
+      end
+    end
+
+    it "should verify authenticity when the request is verified" do
+      klass = Klass.new
+      klass.stub(:verified_request?) { true }
+      klass.send(:verify_authenticity_token).should eq true
+    end
+
+    it "should reset the session when there is no referrer" do
+      klass = Klass.new
+      klass.stub(:verified_request?) { false }
+      klass.stub_chain(:request, :env) { {} }
+      klass.stub(:reset_session) { :reset_session }
+      klass.send(:verify_authenticity_token).should eq :reset_session
+    end
+
+    it "should redirect to the referrer" do
+      klass = Klass.new
+      klass.stub(:verified_request?) { false }
+      klass.stub_chain(:request, :env) { {"HTTP_REFERER" => :URL} }
+      klass.stub(:redirect_to) do |arg|
+        arg
+      end
+      klass.send(:verify_authenticity_token).should eq :URL
+    end
+
+    it "should return the same form authenticity token for a single request" do
+      klass = Klass.new
+      klass.stub_chain(:request, :remote_ip) { "127.0.0.1" }
+      klass.stub(:session) { {:_csrf_token => "2b5194e50c68243dca0bde800d0d1473c3cbc"} }
+      first_token = klass.send(:form_authenticity_token)
+      sleep 1
+      first_token.should eq klass.send(:form_authenticity_token)
+    end
+
+    it "should be able to split an incoming authenticity token into a timestamp and digest" do
+      klass = Klass.new
+      klass.stub_chain(:request, :remote_ip) { "127.0.0.1" }
+      klass.stub(:session) { {:_csrf_token => "2b5194e50c68243dca0bde800d0d1473c3cbc"} }
+      klass.instance_eval { @token = klass.send(:form_authenticity_token) }
+      klass.instance_eval { @token }.should eq klass.send(:form_authenticity_token)
+      time_stamp, digest = klass.send(:split_request_authenticity_token)
+      digest.should eq klass.send(:hexdigest)
+      time_stamp.should eq klass.instance_eval { @stamped_at }
+    end
+
+    it "should reject requests outside the class's authenticity window" do
+      klass = Klass.new
+      class Klass
+        @authenticity_window = -1.day
+      end
+      Klass.authenticity_window.should eq -1.day
+      logger = double("Logger")
+      logger.stub(:warn) { |arg| arg }
+      klass.stub(:logger) { logger }
+      klass.stub(:request_forgery_protection_token) { "" }
+      klass.stub(:flash) { {} }
+      klass.stub_chain(:request, :remote_ip) { "127.0.0.1" }
+      klass.stub(:session) { {:_csrf_token => "2b5194e50c68243dca0bde800d0d1473c3cbc"} }
+      klass.send(:form_authenticity_token)
+      klass.send(:within_authenticity_window?).should eq false
+    end
+
+    it "should accept requests inside the class's authenticity window" do
+      klass = Klass.new
+      klass.stub_chain(:request, :remote_ip) { "127.0.0.1" }
+      klass.stub(:session) { {:_csrf_token => "2b5194e50c68243dca0bde800d0d1473c3cbc"} }
+      klass.send(:form_authenticity_token)
+      klass.send(:within_authenticity_window?).should eq true
+    end
+
+    it "should verify GET requests" do
+      klass = Klass.new
+      klass.stub(:protect_against_forgery?) { true }
+      klass.stub_chain(:request, :get?) { true }
+      klass.send(:verified_request?).should eq true
+    end
+
+    it "should verify non GET requests when protection against forgery is turned off" do
+      klass = Klass.new
+      klass.stub(:protect_against_forgery?) { false }
+      klass.stub_chain(:request, :get?) { false }
+      klass.send(:verified_request?).should eq true
+    end
+
+    it "should verify a request forgery protection token passed in as a parameter" do
+      klass = Klass.new
+      klass.stub(:protect_against_forgery?) { true }
+      klass.stub_chain(:request, :get?) { false }
+      klass.stub(:request_forgery_protection_token) { :_token }
+      klass.stub_chain(:request, :remote_ip) { "127.0.0.1" }
+      klass.stub(:session) { {:_csrf_token => "2b5194e50c68243dca0bde800d0d1473c3cbc"} }
+      klass.stub(:params) { {:_token => klass.send(:form_authenticity_token)} }
+      klass.send(:verified_request?).should eq true
+    end
+
+    it "should verify a request forgery protection token passed in as a header" do
+      klass = Klass.new
+      klass.stub(:protect_against_forgery?) { true }
+      klass.stub_chain(:request, :get?) { false }
+      klass.stub(:params) { {:_token => ""} }
+      klass.stub(:request_forgery_protection_token) { :_token }
+      klass.stub_chain(:request, :remote_ip) { "127.0.0.1" }
+      klass.stub(:session) { {:_csrf_token => "2b5194e50c68243dca0bde800d0d1473c3cbc"} }
+      klass.stub_chain(:request, :headers) { {'X-CSRF-Token' => klass.send(:form_authenticity_token)} }
+      logger = double("Logger")
+      logger.stub(:warn) { |arg| arg }
+      klass.stub(:logger) { logger }
+      klass.send(:verified_request?)
+      klass.send(:verified_request?).should eq true
+    end
+
+    it "should log an invalid request forgery protection token" do
+      # Invalid token in the parameters with valid timestamp and no token in the header
+      klass = Klass.new
+      klass.stub(:protect_against_forgery?) { true }
+      klass.stub_chain(:request, :get?) { false }
+      klass.stub(:params) { {:_token => klass.instance_eval {timestamp} } }
+      klass.stub(:request_forgery_protection_token) { :_token }
+      klass.stub_chain(:request, :remote_ip) { "127.0.0.1" }
+      klass.stub(:session) { {:_csrf_token => "2b5194e50c68243dca0bde800d0d1473c3cbc"} }
+      klass.stub_chain(:request, :headers) { {} }
+      klass.stub(:log_authenticity_mismatch) { |arg| arg.should eq "Invalid _token" }
+      hsh = Hash.new
+      klass.stub(:flash) { hsh }
+      klass.send(:verified_request?).should eq false
+      klass.instance_eval{ flash[:warning] }.should eq Klass.authenticity_invalid_msg
+
+      # No token at all
+      klass.stub(:params) { {} }
+      klass.send(:verified_request?).should eq false
+      klass.instance_eval{ flash[:warning] }.should eq Klass.authenticity_invalid_msg
+
+      # No token in the parameters, invalid token in the header
+      klass.stub_chain(:request, :headers) { {"X-CSRF-Token" => klass.instance_eval {timestamp} } }
+      klass.stub(:log_authenticity_mismatch) { |arg| arg.should eq "Invalid X-CSRF-Token header" }
+      klass.send(:verified_request?).should eq false
+      klass.instance_eval{ flash[:warning] }.should eq Klass.authenticity_invalid_msg
+    end
+  end
+end

data/spec/spec_helper.rb

@@ -0,0 +1,18 @@
+require 'rubygems'
+require 'bundler/setup'
+
+Bundler.require(:development)
+
+require 'action_controller'
+require "active_support/all"
+
+$LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
+$LOAD_PATH.unshift(File.dirname(__FILE__))
+require 'enhanced_request_forgery_protection'
+
+# Requires supporting files with custom matchers and macros, etc,
+# in ./support/ and its subdirectories.
+Dir["#{File.dirname(__FILE__)}/support/**/*.rb"].each {|f| require f}
+
+RSpec.configure do |config|
+end

data/uninstall.rb

@@ -0,0 +1 @@
+# Uninstall hook code here

metadata

@@ -0,0 +1,220 @@
+--- !ruby/object:Gem::Specification 
+name: enhanced_request_forgery_protection
+version: !ruby/object:Gem::Version 
+  hash: 59
+  prerelease: 
+  segments: 
+  - 0
+  - 9
+  - 0
+  version: 0.9.0
+platform: ruby
+authors: 
+- Bart Teeuwisse
+autorequire: 
+bindir: bin
+cert_chain: []
+
+date: 2011-06-03 00:00:00 -07:00
+default_executable: 
+dependencies: 
+- !ruby/object:Gem::Dependency 
+  prerelease: false
+  type: :runtime
+  requirement: &id001 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ~>
+      - !ruby/object:Gem::Version 
+        hash: 9
+        segments: 
+        - 3
+        - 0
+        - 7
+        version: 3.0.7
+  name: actionpack
+  version_requirements: *id001
+- !ruby/object:Gem::Dependency 
+  prerelease: false
+  type: :runtime
+  requirement: &id002 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ~>
+      - !ruby/object:Gem::Version 
+        hash: 9
+        segments: 
+        - 3
+        - 0
+        - 7
+        version: 3.0.7
+  name: activesupport
+  version_requirements: *id002
+- !ruby/object:Gem::Dependency 
+  prerelease: false
+  type: :development
+  requirement: &id003 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ~>
+      - !ruby/object:Gem::Version 
+        hash: 23
+        segments: 
+        - 2
+        - 6
+        - 0
+        version: 2.6.0
+  name: rspec
+  version_requirements: *id003
+- !ruby/object:Gem::Dependency 
+  prerelease: false
+  type: :development
+  requirement: &id004 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        hash: 3
+        segments: 
+        - 0
+        version: "0"
+  name: cucumber
+  version_requirements: *id004
+- !ruby/object:Gem::Dependency 
+  prerelease: false
+  type: :development
+  requirement: &id005 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ~>
+      - !ruby/object:Gem::Version 
+        hash: 23
+        segments: 
+        - 1
+        - 0
+        - 0
+        version: 1.0.0
+  name: bundler
+  version_requirements: *id005
+- !ruby/object:Gem::Dependency 
+  prerelease: false
+  type: :development
+  requirement: &id006 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ~>
+      - !ruby/object:Gem::Version 
+        hash: 7
+        segments: 
+        - 1
+        - 5
+        - 2
+        version: 1.5.2
+  name: jeweler
+  version_requirements: *id006
+- !ruby/object:Gem::Dependency 
+  prerelease: false
+  type: :development
+  requirement: &id007 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        hash: 3
+        segments: 
+        - 0
+        version: "0"
+  name: rcov
+  version_requirements: *id007
+- !ruby/object:Gem::Dependency 
+  prerelease: false
+  type: :development
+  requirement: &id008 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        hash: 3
+        segments: 
+        - 0
+        version: "0"
+  name: ruby-debug
+  version_requirements: *id008
+- !ruby/object:Gem::Dependency 
+  prerelease: false
+  type: :development
+  requirement: &id009 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        hash: 3
+        segments: 
+        - 0
+        version: "0"
+  name: ruby-debug19
+  version_requirements: *id009
+description: Add scopes and time windows to Rails's CSRF protection. Redirect to referrer with a flash message when possible.
+email: bart.teeuwisse@thecodemill.biz
+executables: []
+
+extensions: []
+
+extra_rdoc_files: 
+- LICENSE.txt
+- README.rdoc
+files: 
+- .document
+- .rspec
+- Gemfile
+- Gemfile.lock
+- LICENSE.txt
+- README.rdoc
+- Rakefile
+- VERSION
+- features/enhanced_request_forgery_protection.feature
+- features/step_definitions/enhanced_request_forgery_protection_steps.rb
+- features/support/env.rb
+- install.rb
+- lib/enhanced_request_forgery_protection.rb
+- lib/tasks/enhanced_request_forgery_protection_tasks.rake
+- spec/controllers/enhanced_request_forgery_protection_spec.rb
+- spec/spec_helper.rb
+- uninstall.rb
+has_rdoc: true
+homepage: http://github.com/bartt/enhanced_request_forgery_protection
+licenses: 
+- MIT
+post_install_message: 
+rdoc_options: []
+
+require_paths: 
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement 
+  none: false
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      hash: 3
+      segments: 
+      - 0
+      version: "0"
+required_rubygems_version: !ruby/object:Gem::Requirement 
+  none: false
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      hash: 3
+      segments: 
+      - 0
+      version: "0"
+requirements: []
+
+rubyforge_project: 
+rubygems_version: 1.6.2
+signing_key: 
+specification_version: 3
+summary: A Rails plugin to enhance Rails's basic protect against Cross-Site Request Forgery with scopes and time windows.
+test_files: 
+- spec/controllers/enhanced_request_forgery_protection_spec.rb
+- spec/spec_helper.rb