exvo_auth 0.16.2 → 0.16.3

data/README.md

@@ -38,7 +38,8 @@ ENV['AUTH_CLIENT_SECRET'] = "bar"
 ENV['AUTH_DEBUG']         = "true"          # [OPTIONAL] dumps all HTTP traffic to STDERR, useful during development; it *has to be a string, not a boolean*
 ENV['AUTH_REQUIRE_SSL']   = "false"         # [OPTIONAL] disable SSL, useful in development (note that all apps API urls must be http, not https); it *has to be a string, not a boolean*
 ENV['AUTH_HOST']          = "test.exvo.com" # [OPTIONAL] override the default auth host
-ENV['SSO_COOKIE_SECRET']  = "secret"        # Generate using `SecureRandom.hex(16)`
+ENV['SSO_COOKIE_DOMAIN']  = "example.com"   # [OPTIONAL] set the domain for which the Signle Sign On cookie will be set (default: exvo.com)
+ENV['SSO_COOKIE_SECRET']  = "secret"        # Single Sign On secret key (generate using `SecureRandom.hex(16)`)
 ```
 
 But you can also set things directly in the `config/application.rb` file (before the middleware declaration):
@@ -49,6 +50,7 @@ Exvo::Helpers.auth_client_secret = "bar"
 Exvo::Helpers.auth_debug         = true            # boolean
 Exvo::Helpers.auth_require_ssl   = false           # boolean
 Exvo::Helpers.auth_host          = "test.exvo.com"
+Exvo::Helpers.sso_cookie_domain  = "example.com"
 Exvo::Helpers.sso_cookie_secret  = "secret"
 ```
 

data/lib/exvo_auth/controllers/base.rb

@@ -95,6 +95,12 @@ module ExvoAuth::Controllers::Base
     request.env["omniauth.auth"]
   end
 
+  # CSRF protection for SSO (http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails/)
+  def handle_unverified_request
+    super
+    sign_out_user
+  end
+
   protected
 
   def find_or_create_user_by_uid(uid)

data/lib/exvo_auth/version.rb

@@ -1,3 +1,3 @@
 module ExvoAuth
-  VERSION = "0.16.2"
+  VERSION = "0.16.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: exvo_auth
 version: !ruby/object:Gem::Version
-  version: 0.16.2
+  version: 0.16.3
   prerelease: 
 platform: ruby
 authors:
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-06-22 00:00:00.000000000 Z
+date: 2012-07-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: httparty