global_session 3.2.1 → 3.2.2
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +1 -1
- data/Rakefile +1 -0
- data/VERSION +1 -1
- data/global_session.gemspec +5 -4
- data/lib/global_session/rack.rb +17 -5
- data/lib/global_session/rails/action_controller_instance_methods.rb +1 -1
- data/lib/global_session/session/v1.rb +1 -11
- data/lib/global_session/session/v2.rb +1 -11
- data/lib/global_session/session/v3.rb +1 -11
- metadata +4 -4
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: d83ba1f6c19528e40345cc22eec6ae2563449877
|
4
|
+
data.tar.gz: f27293a41104efc18b42e50419741ec805ba2d6d
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: fa6d5e4bf3e3ced8c5f1377012156ab7102044f6df16d415bebc122bffefaad571318a5f3f0924545463178ae72e605e8b0870d59c2030e9ccab53b7ea1de03d
|
7
|
+
data.tar.gz: 84e1237cd3e053eee017d4d545630a88c801163c90451d97018ae7f74ad78877773c1bf684cf74bce81f1759ea761b68fa9a75b56c99cb128cab9ca228124aeb
|
data/CHANGELOG.md
CHANGED
data/Rakefile
CHANGED
@@ -33,6 +33,7 @@ if require_succeeds? 'jeweler'
|
|
33
33
|
gem.description = %Q{This Rack middleware allows several web apps in an authentication domain to share session state, facilitating single sign-on in a distributed web app. It only provides session sharing and does not concern itself with authentication or replication of the user database.}
|
34
34
|
gem.email = "support@rightscale.com"
|
35
35
|
gem.authors = ['Tony Spataro']
|
36
|
+
gem.required_ruby_version = '~> 2.0'
|
36
37
|
gem.files.exclude 'Gemfile*'
|
37
38
|
gem.files.exclude 'features/**/*'
|
38
39
|
gem.files.exclude 'fixtures/**/*'
|
data/VERSION
CHANGED
@@ -1 +1 @@
|
|
1
|
-
3.2.
|
1
|
+
3.2.2
|
data/global_session.gemspec
CHANGED
@@ -2,16 +2,16 @@
|
|
2
2
|
# DO NOT EDIT THIS FILE DIRECTLY
|
3
3
|
# Instead, edit Jeweler::Tasks in Rakefile, and run 'rake gemspec'
|
4
4
|
# -*- encoding: utf-8 -*-
|
5
|
-
# stub: global_session 3.2.
|
5
|
+
# stub: global_session 3.2.2 ruby lib
|
6
6
|
|
7
7
|
Gem::Specification.new do |s|
|
8
8
|
s.name = "global_session"
|
9
|
-
s.version = "3.2.
|
9
|
+
s.version = "3.2.2"
|
10
10
|
|
11
11
|
s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
|
12
12
|
s.require_paths = ["lib"]
|
13
13
|
s.authors = ["Tony Spataro"]
|
14
|
-
s.date = "2015-
|
14
|
+
s.date = "2015-09-10"
|
15
15
|
s.description = "This Rack middleware allows several web apps in an authentication domain to share session state, facilitating single sign-on in a distributed web app. It only provides session sharing and does not concern itself with authentication or replication of the user database."
|
16
16
|
s.email = "support@rightscale.com"
|
17
17
|
s.extra_rdoc_files = [
|
@@ -21,7 +21,7 @@ Gem::Specification.new do |s|
|
|
21
21
|
s.files = [
|
22
22
|
".ruby-version",
|
23
23
|
".travis.yml",
|
24
|
-
"CHANGELOG.
|
24
|
+
"CHANGELOG.md",
|
25
25
|
"LICENSE",
|
26
26
|
"README.rdoc",
|
27
27
|
"Rakefile",
|
@@ -51,6 +51,7 @@ Gem::Specification.new do |s|
|
|
51
51
|
]
|
52
52
|
s.homepage = "https://github.com/rightscale/global_session"
|
53
53
|
s.licenses = ["MIT"]
|
54
|
+
s.required_ruby_version = Gem::Requirement.new("~> 2.0")
|
54
55
|
s.rubygems_version = "2.2.3"
|
55
56
|
s.summary = "Secure single-domain session sharing plugin for Rack and Rails."
|
56
57
|
|
data/lib/global_session/rack.rb
CHANGED
@@ -19,6 +19,7 @@
|
|
19
19
|
# OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
|
20
20
|
# WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
21
21
|
|
22
|
+
|
22
23
|
require File.expand_path(File.join(File.dirname(__FILE__), "..", "global_session"))
|
23
24
|
|
24
25
|
# Make sure the namespace exists, to satisfy Rails auto-loading
|
@@ -105,8 +106,18 @@ module GlobalSession
|
|
105
106
|
@cookie_name = @configuration['cookie']['name']
|
106
107
|
end
|
107
108
|
|
108
|
-
# Rack request chain.
|
109
|
-
#
|
109
|
+
# Rack request chain. Parses a global session from the request if present;
|
110
|
+
# makes a new session if absent; populates env['global_session'] with the
|
111
|
+
# session object and calls through to the next middleware.
|
112
|
+
#
|
113
|
+
# On return, auto-renews the session if appropriate and writes a new
|
114
|
+
# session cookie if anything in the session has changed.
|
115
|
+
#
|
116
|
+
# When reading session cookies or authorization headers, this middleware
|
117
|
+
# URL-decodes cookie/token values before passing them into the gem's
|
118
|
+
# other logic. Some user agents and proxies "helpfully" URL-encode cookies
|
119
|
+
# which we need to undo in order to prevent subtle signature failures due
|
120
|
+
# to Base64 decoding issues resulting from "=" being URL-encoded.
|
110
121
|
#
|
111
122
|
# @return [Array] valid Rack response tuple e.g. [200, 'hello world']
|
112
123
|
# @param [Hash] env Rack request environment
|
@@ -163,7 +174,7 @@ module GlobalSession
|
|
163
174
|
if header_data && header_data.size == 2 && header_data.first.downcase == 'bearer'
|
164
175
|
env['global_session.req.renew'] = false
|
165
176
|
env['global_session.req.update'] = false
|
166
|
-
env['global_session'] = @directory.load_session(header_data.last)
|
177
|
+
env['global_session'] = @directory.load_session(CGI.unescape(header_data.last))
|
167
178
|
true
|
168
179
|
else
|
169
180
|
false
|
@@ -176,10 +187,11 @@ module GlobalSession
|
|
176
187
|
# @param [Hash] env Rack request environment
|
177
188
|
def read_cookie(env)
|
178
189
|
if @cookie_retrieval && (cookie = @cookie_retrieval.call(env))
|
179
|
-
env['global_session'] = @directory.load_session(cookie)
|
190
|
+
env['global_session'] = @directory.load_session(CGI.unescape(cookie))
|
180
191
|
true
|
181
192
|
elsif env['rack.cookies'].has_key?(@cookie_name)
|
182
|
-
|
193
|
+
cookie = env['rack.cookies'][@cookie_name]
|
194
|
+
env['global_session'] = @directory.load_session(CGI.unescape(cookie))
|
183
195
|
true
|
184
196
|
else
|
185
197
|
false
|
@@ -142,7 +142,7 @@ module GlobalSession
|
|
142
142
|
|
143
143
|
logger.info(request_id)
|
144
144
|
|
145
|
-
parameters = respond_to?(:filter_parameters) ? filter_parameters(params) : params.dup
|
145
|
+
parameters = respond_to?(:filter_parameters, true) ? filter_parameters(params) : params.dup
|
146
146
|
parameters = parameters.except!(:controller, :action, :format, :_method)
|
147
147
|
|
148
148
|
logger.info " Parameters: #{parameters.inspect}" unless parameters.empty?
|
@@ -66,7 +66,7 @@ module GlobalSession::Session
|
|
66
66
|
'tc' => @created_at.to_i, 'te' => @expired_at.to_i,
|
67
67
|
'ds' => @signed}
|
68
68
|
|
69
|
-
if @signature &&
|
69
|
+
if @signature && !dirty?
|
70
70
|
#use cached signature unless we've changed secure state
|
71
71
|
authority = @authority
|
72
72
|
else
|
@@ -170,16 +170,6 @@ module GlobalSession::Session
|
|
170
170
|
return value
|
171
171
|
end
|
172
172
|
|
173
|
-
# Renews this global session, changing its expiry timestamp into the future.
|
174
|
-
# Causes a new signature will be computed when the session is next serialized.
|
175
|
-
#
|
176
|
-
# === Return
|
177
|
-
# true:: Always returns true
|
178
|
-
def renew!(expired_at=nil)
|
179
|
-
super(expired_at)
|
180
|
-
@dirty_secure = true
|
181
|
-
end
|
182
|
-
|
183
173
|
# Return the SHA1 hash of the most recently-computed RSA signature of this session.
|
184
174
|
# This isn't really intended for the end user; it exists so the Web framework integration
|
185
175
|
# code can optimize request speed by caching the most recently verified signature in the
|
@@ -67,7 +67,7 @@ module GlobalSession::Session
|
|
67
67
|
'tc' => @created_at.to_i, 'te' => @expired_at.to_i,
|
68
68
|
'ds' => @signed}
|
69
69
|
|
70
|
-
if @signature &&
|
70
|
+
if @signature && !dirty?
|
71
71
|
#use cached signature unless we've changed secure state
|
72
72
|
authority = @authority
|
73
73
|
else
|
@@ -171,16 +171,6 @@ module GlobalSession::Session
|
|
171
171
|
return value
|
172
172
|
end
|
173
173
|
|
174
|
-
# Renews this global session, changing its expiry timestamp into the future.
|
175
|
-
# Causes a new signature will be computed when the session is next serialized.
|
176
|
-
#
|
177
|
-
# === Return
|
178
|
-
# true:: Always returns true
|
179
|
-
def renew!(expired_at=nil)
|
180
|
-
super(expired_at)
|
181
|
-
@dirty_secure = true
|
182
|
-
end
|
183
|
-
|
184
174
|
# Return the SHA1 hash of the most recently-computed RSA signature of this session.
|
185
175
|
# This isn't really intended for the end user; it exists so the Web framework integration
|
186
176
|
# code can optimize request speed by caching the most recently verified signature in the
|
@@ -130,7 +130,7 @@ module GlobalSession::Session
|
|
130
130
|
'tc' => @created_at.to_i, 'te' => @expired_at.to_i,
|
131
131
|
'ds' => @signed}
|
132
132
|
|
133
|
-
if @signature &&
|
133
|
+
if @signature && !dirty?
|
134
134
|
#use cached signature unless we've changed secure state
|
135
135
|
authority = @authority
|
136
136
|
else
|
@@ -235,16 +235,6 @@ module GlobalSession::Session
|
|
235
235
|
return value
|
236
236
|
end
|
237
237
|
|
238
|
-
# Renews this global session, changing its expiry timestamp into the future.
|
239
|
-
# Causes a new signature will be computed when the session is next serialized.
|
240
|
-
#
|
241
|
-
# === Return
|
242
|
-
# true:: Always returns true
|
243
|
-
def renew!(expired_at=nil)
|
244
|
-
super(expired_at)
|
245
|
-
@dirty_secure = true
|
246
|
-
end
|
247
|
-
|
248
238
|
# Return the SHA1 hash of the most recently-computed RSA signature of this session.
|
249
239
|
# This isn't really intended for the end user; it exists so the Web framework integration
|
250
240
|
# code can optimize request speed by caching the most recently verified signature in the
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: global_session
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 3.2.
|
4
|
+
version: 3.2.2
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Tony Spataro
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2015-
|
11
|
+
date: 2015-09-11 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: json
|
@@ -178,9 +178,9 @@ require_paths:
|
|
178
178
|
- lib
|
179
179
|
required_ruby_version: !ruby/object:Gem::Requirement
|
180
180
|
requirements:
|
181
|
-
- - "
|
181
|
+
- - "~>"
|
182
182
|
- !ruby/object:Gem::Version
|
183
|
-
version: '0'
|
183
|
+
version: '2.0'
|
184
184
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
185
185
|
requirements:
|
186
186
|
- - ">="
|