header_guard 0.1.1 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e1b0c70ef3860e8eb858d0f1788b6f77693dd832c49a26f4a6d7d30a8e16989a
-  data.tar.gz: b7938f96c5900e6fa4f7f80034baf438277b9759592d5136c072d0de94630b79
+  metadata.gz: af8346262e02cbf08a1efb6b7de1ea08d55f8d262be2801421a8f848796b96e4
+  data.tar.gz: f8a9d346ca8ba26ae507d99d1780a97be8499e9e5e537239de32fee4fb043ed8
 SHA512:
-  metadata.gz: e38ca2186bcfe23bcd7fce5b6c48d660f007bef259f36ff527858c43a742fdc60bd9ed417a0821d2852a3ea840c4688e5a621265579ad85ae3dda6de87630342
-  data.tar.gz: fceb2b577b294e6d026ddda01416b4c09ef48e88b86db274242f68993f72882da8e1ad9b60fe5bbec24aab29ae4776049cd90e35d11df0eb50e97add9d76c9c6
+  metadata.gz: b08e3c213d232cb27d04eb8714f71894b9dfd9b0543d02ed971d9171551ecde1d57b2b57a938019facf9c5d69f568096453c7aa20b1a347e3067f2734dcc20b8
+  data.tar.gz: bb04592f757450600bae59a35b2572253642af6aa69af37e8c4e6724657b22d294a5aa6d859c39a2354262f42d13a9883be92a4b63d83d7b11321eb186578e7c

data/CHANGELOG.md

@@ -0,0 +1,70 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+See `PLAN.md` for the remaining remediation work (P1–P5), targeted at 0.2.0.
+
+## [0.1.2] - 2026-09-08
+
+### Fixed
+
+- **Security headers were silently not injected on conformant Rack 3 applications.**
+  The HTML check read `headers["Content-Type"]`, but the Rack 3 SPEC requires response
+  header keys to be lowercase. An application returning a plain Hash such as
+  `{"content-type" => "text/html"}` received **no** security headers at all — no HSTS,
+  no CSP, no `nosniff` — with no error raised. The gem only appeared to work for
+  applications built on `Rack::Response`, which returns a case-insensitive
+  `Rack::Headers`. Header lookup is now case-insensitive, so both Rack 2 and Rack 3
+  style responses are detected.
+
+- **Emitted header names violated the Rack 3 SPEC.** Headers were written with
+  capitalized keys (`Strict-Transport-Security`), which `Rack::Lint` rejects with
+  `uppercase character in header name`. All injected headers are now written in
+  lowercase.
+
+- **A header set by the application under a different capitalization is no longer
+  duplicated.** Previously an app setting `X-Frame-Options` would end up with both its
+  own key and the middleware's, sending the header twice. Differently-cased duplicates
+  are removed before the middleware writes its value.
+
+- **A custom header option now overrides the matching default regardless of case.**
+  Passing `"x-frame-options" => "SAMEORIGIN"` previously appended a second header
+  instead of replacing the default.
+
+- **Previously released `.gem` files are no longer packaged inside new releases.**
+  `header_guard-0.1.0.gem` and `header_guard-0.1.1.gem` were tracked in git, and the
+  gemspec filtered only the *current* version's file, so each release bundled every
+  earlier one — 0.1.1 was 16KB largely because it contained 0.1.0. The artifacts are now
+  untracked and gitignored, and the gemspec rejects any `.gem` file rather than one
+  specific name. `PLAN.md` is excluded from the package as well.
+
+### Changed
+
+- Injected response header names are now lowercase. This is invisible over HTTP, where
+  header names are case-insensitive, but code inspecting the raw Rack headers Hash by an
+  exact capitalized key needs to be updated. `Rack::Headers` and `Rack::Test` lookups are
+  unaffected.
+
+## [0.1.1] - 2025-10-20
+
+### Fixed
+
+- Corrected the `homepage` metadata in the gemspec.
+
+## [0.1.0] - 2025-10-20
+
+### Added
+
+- Initial release: Rack middleware injecting HSTS, `X-Content-Type-Options`,
+  `X-Frame-Options`, `Referrer-Policy` and a configurable Content Security Policy,
+  with `report_only` support.
+
+[Unreleased]: https://github.com/danielefrisanco/headerguard/compare/v0.1.2...HEAD
+[0.1.2]: https://github.com/danielefrisanco/headerguard/compare/v0.1.1...v0.1.2
+[0.1.1]: https://github.com/danielefrisanco/headerguard/compare/v0.1.0...v0.1.1
+[0.1.0]: https://github.com/danielefrisanco/headerguard/releases/tag/v0.1.0

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    header_guard (0.1.1)
+    header_guard (0.1.2)
       rack (~> 3.0)
 
 GEM
@@ -35,4 +35,4 @@ DEPENDENCIES
   rspec (~> 3.12)
 
 BUNDLED WITH
-   2.4.22
+   2.4.9

data/header_guard.gemspec

@@ -12,11 +12,15 @@ Gem::Specification.new do |spec|
   spec.description   = "Designed for applications that require strong browser-side security, HeaderGuard automatically injects HSTS, X-Content-Type-Options, X-Frame-Options, and a customizable CSP. Ideal for SSO and high-security web services."
   spec.homepage      = "https://github.com/danielefrisanco/headerguard"
   spec.license       = "MIT"
-  spec.required_ruby_version = ">= 2.6.6" 
+  spec.required_ruby_version = ">= 2.6.6"
   # Specify which files should be added to the gem when it is released.
   spec.files = Dir.chdir(File.expand_path(__dir__)) do
     `git ls-files -z`.split("\x0").reject do |f|
-      (f == spec.full_name + ".gem") ||
+      # Never package build artifacts or internal planning docs. Matching any
+      # ".gem" (not just the current version's) keeps a stray local build from
+      # being bundled into a release.
+      f.end_with?(".gem") ||
+        f == "PLAN.md" ||
         f.match(%r{\A(?:(?:test|spec|features)/|\.(?:git|travis|circleci)|appveyor)})
     end
   end

data/lib/header_guard/middleware.rb

@@ -2,6 +2,11 @@
 
 module HeaderGuard
   # The Rack middleware class responsible for injecting security headers.
+  #
+  # Header names are treated case-insensitively throughout. The Rack 3 SPEC
+  # requires response header keys to be lowercase, while Rack 2 applications
+  # conventionally use capitalized keys, so this middleware reads incoming
+  # headers case-insensitively and always writes lowercase keys.
   class Middleware
     # Initializes the middleware. It merges user-defined options over defaults.
     #
@@ -9,7 +14,7 @@ module HeaderGuard
     # @param options [Hash] Configuration options for headers and CSP.
     def initialize(app, options = {})
       @app = app
-      
+
       # Use a copy of options for configuration extraction
       config = options.dup
 
@@ -18,14 +23,17 @@ module HeaderGuard
       @report_only = config.delete(:report_only) || false
 
       # 1. Start with DEFAULT_HEADERS (from header_guard.rb)
-      # 2. Merge remaining options (which are custom headers) over the defaults.
-      # THIS IS THE FIX: By merging 'config' (which now only contains headers)
-      # over the defaults, the user's header values take precedence.
-      @headers = DEFAULT_HEADERS.merge(config).freeze
+      # 2. Merge remaining options (which are custom headers) over the defaults,
+      #    so the user's header values take precedence.
+      # 3. Normalize every key to lowercase, so a custom "X-Frame-Options"
+      #    overrides the default rather than being emitted alongside it.
+      @headers = DEFAULT_HEADERS.merge(config).each_with_object({}) do |(key, value), normalized|
+        normalized[normalize_key(key)] = value
+      end.freeze
 
       # Set the final CSP value and the header key based on report_only setting
       @csp_value = custom_csp || DEFAULT_CSP
-      @csp_header_key = @report_only ? "Content-Security-Policy-Report-Only" : "Content-Security-Policy"
+      @csp_header_key = @report_only ? "content-security-policy-report-only" : "content-security-policy"
     end
 
     # The Rack application call method.
@@ -34,21 +42,53 @@ module HeaderGuard
 
       # Only inject headers on successful (2xx) responses with HTML content.
       # Exclude redirects, errors, and non-HTML assets (like JSON or images).
-      if (200..299).include?(status) && headers["Content-Type"]&.include?("text/html")
-        
+      if (200..299).include?(status) && html?(headers)
         # Inject the standard headers
         @headers.each do |key, value|
-          # We use assignment (=) here, not `||=`, to ensure the middleware
+          # We use assignment here, not `||=`, to ensure the middleware
           # overwrites any headers set by the application before it,
           # adhering to the strong security posture.
-          headers[key] = value 
+          assign(headers, key, value)
         end
-        
+
         # Inject the configured CSP header
-        headers[@csp_header_key] = @csp_value
+        assign(headers, @csp_header_key, @csp_value)
       end
 
       [status, headers, body]
     end
+
+    private
+
+    def normalize_key(key)
+      key.to_s.downcase
+    end
+
+    def html?(headers)
+      fetch_header(headers, "content-type")&.include?("text/html")
+    end
+
+    # Rack 3 responses key headers in lowercase; Rack 2 applications typically
+    # send "Content-Type". A Rack::Headers hash resolves either directly, but a
+    # plain Hash does not, so fall back to scanning for a case-insensitive match.
+    def fetch_header(headers, key)
+      return headers[key] if headers.key?(key)
+
+      match = headers.keys.find { |candidate| normalize_key(candidate) == key }
+      match && headers[match]
+    end
+
+    # Writes the lowercase key, first removing any differently-cased duplicate
+    # the application may have set, so the response never carries the same
+    # header twice under two spellings.
+    def assign(headers, key, value)
+      headers.keys.each do |existing|
+        next if existing == key
+
+        headers.delete(existing) if normalize_key(existing) == key
+      end
+
+      headers[key] = value
+    end
   end
 end

data/lib/header_guard/version.rb

@@ -2,5 +2,5 @@
 
 module HeaderGuard
   # The current version of the HeaderGuard gem.
-  VERSION = "0.1.1"
+  VERSION = "0.1.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: header_guard
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors:
 - Gemini AI
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2025-10-20 00:00:00.000000000 Z
+date: 2026-09-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -62,11 +62,11 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- CHANGELOG.md
 - Gemfile
 - Gemfile.lock
 - LICENSE.txt
 - README.md
-- header_guard-0.1.0.gem
 - header_guard.gemspec
 - lib/header_guard.rb
 - lib/header_guard/middleware.rb
@@ -90,7 +90,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.3
+rubygems_version: 3.3.26
 signing_key: 
 specification_version: 4
 summary: A robust Rack middleware for enforcing modern HTTP security headers, including