global_session 3.1.1 → 3.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 4076acba8dcf282c7dad88a0d0970849c24be12d
-  data.tar.gz: 2868c88a7927c381c23c4015da1dc31794f41238
+  metadata.gz: c515a5dcc7b904111d8d920ec99e0ccdce58121f
+  data.tar.gz: 5d64ca49728e08bd110fc597ff5321a951983041
 SHA512:
-  metadata.gz: 62a9e4d919ecee5c1f182f78b2e28ae55baf5430a1538ae5b7df6bf03323c4b61a0df003583a096cf29c6776409c4076ea19d6cdac9ddae3e5b86971fd5908f0
-  data.tar.gz: eca8e7350d16946e5417168f6b4ebdb3a52c4322714b1682f0df993b85f78c8887c747a9716db0bce10a7b94107231c3c8424c3ca620b61966a4c649d9dd0c95
+  metadata.gz: ba37377a8a6489d088ca0f835dc61be4bacba59472249802358a686b6500315f438e846a3e73142923fce67cc7b7646de9948577cb73ff22b5aa3d8dba604142
+  data.tar.gz: a43759e7a9d51b6322c04c41f19821229b35bce347dcf76d1ea3a5f65ccfa60a9cab1112f13a448cd20c390a84cff339cff2a4d9c0c7e940479d0411246bc878

data/.ruby-version

@@ -0,0 +1 @@
+2.1.6

data/VERSION

@@ -1 +1 @@
-3.1.1
+3.2.0

data/global_session.gemspec

@@ -2,16 +2,16 @@
 # DO NOT EDIT THIS FILE DIRECTLY
 # Instead, edit Jeweler::Tasks in Rakefile, and run 'rake gemspec'
 # -*- encoding: utf-8 -*-
-# stub: global_session 3.1.1 ruby lib
+# stub: global_session 3.2.0 ruby lib
 
 Gem::Specification.new do |s|
   s.name = "global_session"
-  s.version = "3.1.1"
+  s.version = "3.2.0"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.require_paths = ["lib"]
   s.authors = ["Tony Spataro"]
-  s.date = "2015-05-22"
+  s.date = "2015-07-08"
   s.description = "This Rack middleware allows several web apps in an authentication domain to share session state, facilitating single sign-on in a distributed web app. It only provides session sharing and does not concern itself with authentication or replication of the user database."
   s.email = "support@rightscale.com"
   s.extra_rdoc_files = [
@@ -50,7 +50,7 @@ Gem::Specification.new do |s|
   ]
   s.homepage = "https://github.com/rightscale/global_session"
   s.licenses = ["MIT"]
-  s.rubygems_version = "2.2.2"
+  s.rubygems_version = "2.2.3"
   s.summary = "Secure single-domain session sharing plugin for Rack and Rails."
 
   if s.respond_to? :specification_version then

data/lib/global_session/rack.rb

@@ -27,6 +27,8 @@ module GlobalSession
     # Global session middleware.  Note: this class relies on
     # Rack::Cookies being used higher up in the chain.
     class Middleware
+      NUMERIC_HOST      = /^[0-9.]+$/.freeze
+
       LOCAL_SESSION_KEY = "rack.session".freeze
 
       # @return [GlobalSession::Configuration]
@@ -232,13 +234,15 @@ module GlobalSession
           value   = session.to_s
           expires = @configuration['ephemeral'] ? nil : session.expired_at
           unless env['rack.cookies'][@cookie_name] == value
+            secure = (env['HTTP_X_FORWARDED_PROTO'] == 'https') ||
+                     (env['rack.url_scheme'] == 'https')
             env['rack.cookies'][@cookie_name] =
               {
                 :value    => value,
                 :domain   => cookie_domain(env),
                 :expires  => expires,
                 :httponly => true,
-                :secure   => (env['rack.url_scheme'] == 'https'),
+                :secure   => secure,
               }
           end
         else
@@ -316,14 +320,27 @@ module GlobalSession
       #
       # @param [Hash] env Rack request environment
       def cookie_domain(env)
+        name = env['HTTP_X_FORWARDED_HOST'] || env['SERVER_NAME']
+
         if @configuration['cookie'].has_key?('domain')
           # Use the explicitly provided domain name
           domain = @configuration['cookie']['domain']
+        elsif name =~ NUMERIC_HOST
+          # Don't set a domain if the browser requested an IP-based host
+          domain = nil
         else
-          # Use the server name, but strip off the most specific component
-          parts  = env['SERVER_NAME'].split('.')
-          parts  = parts[1..-1] if parts.length > 2
-          domain = parts.join('.')
+          # Guess an appropriate domain for the cookie. Strip one level of
+          # subdomain; leave SLDs unmolested; omit domain entirely for
+          # one-component domains (e.g. localhost).
+          parts  = name.split('.')
+          case parts.length
+          when 0..1
+            domain = nil
+          when 2
+            domain = parts.join('.')
+          else
+            domain = parts[1..-1].join('.')
+          end
         end
 
         domain

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: global_session
 version: !ruby/object:Gem::Version
-  version: 3.1.1
+  version: 3.2.0
 platform: ruby
 authors:
 - Tony Spataro
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-05-27 00:00:00.000000000 Z
+date: 2015-07-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: json
@@ -139,6 +139,7 @@ extra_rdoc_files:
 - LICENSE
 - README.rdoc
 files:
+- ".ruby-version"
 - ".travis.yml"
 - CHANGELOG.rdoc
 - LICENSE
@@ -187,7 +188,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.2.2
+rubygems_version: 2.2.3
 signing_key: 
 specification_version: 4
 summary: Secure single-domain session sharing plugin for Rack and Rails.