idempo 1.3.0 → 1.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3db7fbb3c612bae5675890f118986c3d026e49c73f3c74c24f15fea51e6a67c7
-  data.tar.gz: 65a193261af6e424fe8f7e3437d28e02c20ddb4c9ae199c9556f39676474b8ac
+  metadata.gz: 45bef4736adac3732c5b4d29013ca996f3801f3cb66bbb55d1dc554faeef2f99
+  data.tar.gz: 61e7a98fd4593390dc446d2f1656dde637a5e88612f6439104bdc3a5de3f6828
 SHA512:
-  metadata.gz: bd32562481a479070ed2806ef3201d370417fd9acfbbb8499d1aefb2f1000f278ee3dff47ccb0ac640f33001be8c41cccba7c498980d07c893dee519e53f539b
-  data.tar.gz: df3b05f901ac7e49bb82bfde9a522e2a179b96953db10751b7814858597a5a0af0aa82ff0fd6824e3a11cae6bdf4ebc84004a35b09cfae7a39958114a307eef8
+  metadata.gz: 5e594aaf41686081d0bb007513d4dcbe436df1d814e4d14106d2b709e766dcad4c13264aba3c6478d80a362a5e7f87e38a1890224e140f8e9d9b9765180e3f01
+  data.tar.gz: 8e7557b7aaf0312edf59b86a536fda9cc703adc639f3ffb8e49e18e73b2dec1e451564cafdd720482cb7b66cf6a02031afb4eada933c78f11344ec1db24518e3

data/CHANGELOG.md

@@ -1,3 +1,16 @@
+## 1.4.0
+
+- `RequestFingerprint` is now a class instead of a module, with an overridable `extract_user_identity` method.
+  The default implementation uses the `Authorization` header when present, and falls back to the Rails session
+  cookie (`_<appname>_session`) when it is not. This prevents cross-user response leakage for apps using
+  cookie-based authentication. For custom auth mechanisms, subclass `RequestFingerprint` and override
+  `extract_user_identity`. Backward compatible — the class still works as the default `compute_fingerprint_via:` value.
+
+## 1.3.1
+
+- Instead of retaining the ActiveRecord connection in Idempo operations, check it out temporarily from the AR pool.
+  This should improve interop with fibers/Async.
+
 ## 1.3.0
 
 - Streamline integration with both Rack 2 and 3, add tests for request fingerprinting.

data/examples/jwt_iss_fingerprint.rb

@@ -2,26 +2,15 @@
 # which includes some form of expiration. This means that every time a request is made, the `Authorization`
 # HTTP header may have a different value, and thus the request fingerprint could change every time,
 # even though the idempotency key is the same.
-# For this case, a custom fingerprinting function can be used. For example, if the bearer token is
-# generated in JWT format by the client, it may include the `iss` (issuer) claim, identifying the
-# specific device. This identifier can then be used instead of the entire Authorization header.
+# For this case, you can subclass Idempo::RequestFingerprint and override `extract_user_identity`.
+# For example, if the bearer token is generated in JWT format by the client, it may include the
+# `iss` (issuer) claim, identifying the specific device. This identifier can then be used instead
+# of the entire Authorization header.
 
-module FingerprinterWithIssuerClaim
-  def self.call(idempotency_key, rack_request)
-    d = Digest::SHA256.new
-    d << idempotency_key << "\n"
-    d << rack_request.url << "\n"
-    d << rack_request.request_method << "\n"
-    d << extract_jwt_iss_claim(rack_request) << "\n"
-    while (chunk = rack_request.env["rack.input"].read(1024 * 65))
-      d << chunk
-    end
-    Base64.strict_encode64(d.digest)
-  ensure
-    rack_request.env["rack.input"].rewind
-  end
+class JwtIssFingerprint < Idempo::RequestFingerprint
+  private
 
-  def self.extract_jwt_iss_claim(rack_request)
+  def extract_user_identity(rack_request)
     header_value = rack_request.get_header("HTTP_AUTHORIZATION").to_s
     return header_value unless header_value.start_with?("Bearer ")
 
@@ -39,3 +28,5 @@ module FingerprinterWithIssuerClaim
     SecureRandom.bytes(32)
   end
 end
+
+use Idempo, compute_fingerprint_via: JwtIssFingerprint.new

data/lib/idempo/active_record_backend.rb

@@ -82,13 +82,15 @@ class Idempo::ActiveRecordBackend
     # process) and then once we have that - the DB lock.
     @memory_lock.with(request_key) do
       db_safe_key = Digest::SHA1.base64digest(request_key)
-      database_lock = lock_implementation_for_connection(model.connection)
-      raise Idempo::ConcurrentRequest unless database_lock.acquire(model.connection, request_key)
+      ActiveRecord::Base.connection_pool.with_connection do |connection|
+        database_lock = lock_implementation_for_connection(connection)
+        raise Idempo::ConcurrentRequest unless database_lock.acquire(connection, request_key)
 
-      begin
-        yield(Store.new(db_safe_key, model))
-      ensure
-        database_lock.release(model.connection, request_key)
+        begin
+          yield(Store.new(db_safe_key, model))
+        ensure
+          database_lock.release(connection, request_key)
+        end
       end
     end
   end

data/lib/idempo/request_fingerprint.rb

@@ -1,10 +1,20 @@
-module Idempo::RequestFingerprint
+# frozen_string_literal: true
+
+class Idempo::RequestFingerprint
+  RAILS_SESSION_COOKIE_PATTERN = /\A_[a-z0-9_]+_session\z/i
+
+  # Maintains backward compatibility: Idempo::RequestFingerprint can be passed
+  # directly as the compute_fingerprint_via: value (the default) since it responds to .call.
   def self.call(idempotency_key, rack_request)
+    new.call(idempotency_key, rack_request)
+  end
+
+  def call(idempotency_key, rack_request)
     d = Digest::SHA256.new
     d << idempotency_key << "\n"
     d << rack_request.url << "\n"
     d << rack_request.request_method << "\n"
-    d << rack_request.get_header("HTTP_AUTHORIZATION").to_s << "\n"
+    d << extract_user_identity(rack_request).to_s << "\n"
 
     # Under Rack 3.0 the rack.input may or may not be rewindable (this is done to support
     # streaming HTTP request bodies). If we know a request body is rewindable we can read it
@@ -18,7 +28,62 @@ module Idempo::RequestFingerprint
     Base64.strict_encode64(d.digest)
   end
 
-  def self.read_and_rewind(source_io, to_destination_io)
+  # Extracts a value identifying the user from the request. This value gets
+  # included in the request fingerprint hash. Without user identity in the
+  # fingerprint, two different users sending the same idempotency key to the
+  # same endpoint would receive each other's cached responses — leaking
+  # sensitive data across user boundaries (similar to the Railway CDN caching
+  # incident of March 2026, where responses keyed only on method+URL were
+  # served to the wrong users).
+  #
+  # The default implementation tries two strategies, in order:
+  #
+  # 1. If an Authorization header is present (Bearer token, Basic auth, etc.),
+  #    its full value is used. This is the common case for API applications.
+  #    Different tokens produce different fingerprints, so requests from
+  #    different users are naturally separated.
+  #
+  # 2. If no Authorization header is present, we look for a Rails-style session
+  #    cookie (matching the pattern `_<appname>_session`). This covers the
+  #    common case of Rails applications using cookie-based authentication,
+  #    where the Authorization header is typically empty for all users. The
+  #    encrypted session cookie value differs per user session, so it serves
+  #    as a user identity signal. The cookie value is stable from the client's
+  #    perspective across retries (the client resends the same cookie string
+  #    until it receives a Set-Cookie with a new value), which is what matters
+  #    for idempotency — the retry sends the same fingerprint as the original.
+  #
+  # If neither signal is available (no Authorization header and no Rails
+  # session cookie), the fingerprint will only contain the idempotency key,
+  # URL, method, and body. This is acceptable for unauthenticated endpoints
+  # but DANGEROUS for authenticated endpoints using other identity mechanisms
+  # (custom headers like X-API-Key, non-Rails session cookies, etc.).
+  #
+  # To handle those cases, subclass and override this method:
+  #
+  #   class MyFingerprint < Idempo::RequestFingerprint
+  #     private
+  #     def extract_user_identity(rack_request)
+  #       rack_request.get_header("HTTP_X_API_KEY")
+  #     end
+  #   end
+  #
+  #   use Idempo, compute_fingerprint_via: MyFingerprint.new
+  #
+  def extract_user_identity(rack_request)
+    auth = rack_request.get_header("HTTP_AUTHORIZATION").to_s
+    return auth unless auth.empty?
+    extract_rails_session_cookie(rack_request)
+  end
+
+  def extract_rails_session_cookie(rack_request)
+    rack_request.cookies.each do |name, value|
+      return value if name.match?(RAILS_SESSION_COOKIE_PATTERN)
+    end
+    nil
+  end
+
+  def read_and_rewind(source_io, to_destination_io)
     while (chunk = source_io.read(1024 * 65))
       to_destination_io << chunk
     end

data/lib/idempo/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 class Idempo
-  VERSION = "1.3.0"
+  VERSION = "1.4.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: idempo
 version: !ruby/object:Gem::Version
-  version: 1.3.0
+  version: 1.4.0
 platform: ruby
 authors:
 - Julik Tarkhanov
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-11-29 00:00:00.000000000 Z
+date: 2026-04-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: msgpack