last_line 0.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- data/MIT-LICENSE +20 -0
- data/README.md +90 -0
- data/Rakefile +35 -0
- data/lib/last_line/controller.rb +48 -0
- data/lib/last_line/railtie.rb +12 -0
- data/lib/last_line/version.rb +3 -0
- data/lib/last_line.rb +4 -0
- data/test/dummy/app/controllers/application_controller.rb +3 -0
- data/test/dummy/config/application.rb +10 -0
- data/test/dummy/config/boot.rb +10 -0
- data/test/dummy/config/environment.rb +5 -0
- data/test/dummy/config/routes.rb +3 -0
- data/test/dummy/config.ru +3 -0
- data/test/dummy/log/test.log +463 -0
- data/test/protected_controller_test.rb +49 -0
- data/test/test_helper.rb +5 -0
- metadata +88 -0
data/MIT-LICENSE
ADDED
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
Copyright 2013 Eugene Kalenkovich
|
|
2
|
+
|
|
3
|
+
Permission is hereby granted, free of charge, to any person obtaining
|
|
4
|
+
a copy of this software and associated documentation files (the
|
|
5
|
+
"Software"), to deal in the Software without restriction, including
|
|
6
|
+
without limitation the rights to use, copy, modify, merge, publish,
|
|
7
|
+
distribute, sublicense, and/or sell copies of the Software, and to
|
|
8
|
+
permit persons to whom the Software is furnished to do so, subject to
|
|
9
|
+
the following conditions:
|
|
10
|
+
|
|
11
|
+
The above copyright notice and this permission notice shall be
|
|
12
|
+
included in all copies or substantial portions of the Software.
|
|
13
|
+
|
|
14
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
|
15
|
+
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
|
16
|
+
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
|
17
|
+
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
|
|
18
|
+
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
|
|
19
|
+
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
|
|
20
|
+
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
data/README.md
ADDED
|
@@ -0,0 +1,90 @@
|
|
|
1
|
+
# LastLine
|
|
2
|
+
|
|
3
|
+
## Last Line of CSRF Defence
|
|
4
|
+
|
|
5
|
+
Rails provides CSRF protection for your application out of the box. This protection
|
|
6
|
+
covers only non-GET (or HEAD) requests, as GET requests are not supposed to change any state.
|
|
7
|
+
Unfortunately, there are two main gaps in default CSRF prevention:
|
|
8
|
+
|
|
9
|
+
- Routing information is handled independently from controller logic. It is not trivial to trace
|
|
10
|
+
which actions are allowed to process GET requests. Most common example - un-commenting generic route
|
|
11
|
+
`match ':controller(/:action(/:id))(.:format)'` (hidden at the end of `routes.rb`) opens all controller
|
|
12
|
+
actions to GET requests.
|
|
13
|
+
|
|
14
|
+
- Sometimes it is important to provide CSRF protection for GET requests too. Common use case for this -
|
|
15
|
+
redirect from external service, like third party authentication.
|
|
16
|
+
|
|
17
|
+
LastLine is an attempt to bridge these gaps. It provides
|
|
18
|
+
|
|
19
|
+
- Whitelisting actions for GET requests on controller level
|
|
20
|
+
|
|
21
|
+
- A way to verify authenticity token for GET request
|
|
22
|
+
|
|
23
|
+
## Installation
|
|
24
|
+
|
|
25
|
+
Include in your Gemfile
|
|
26
|
+
|
|
27
|
+
gem 'last_line'
|
|
28
|
+
|
|
29
|
+
and run
|
|
30
|
+
|
|
31
|
+
bundle install
|
|
32
|
+
|
|
33
|
+
## Usage
|
|
34
|
+
|
|
35
|
+
### Whitelisting GET actions
|
|
36
|
+
To require GET request whitelisting for the whole application, insert `protect_from_gets` in your
|
|
37
|
+
`ApplicationController` after `protect_from_forgery`:
|
|
38
|
+
|
|
39
|
+
class ApplicationController < ActionController::Base
|
|
40
|
+
protect_from_forgery
|
|
41
|
+
protect_from_gets
|
|
42
|
+
[...]
|
|
43
|
+
end
|
|
44
|
+
|
|
45
|
+
In case you want to whitelist GETs in a particular controller only, insert the same line in your controller
|
|
46
|
+
instead of `ApplicationController` (not recommended)
|
|
47
|
+
|
|
48
|
+
If you want to whitelist GET actions in your application, but exclude some controller from whitelisting
|
|
49
|
+
(not recommended):
|
|
50
|
+
|
|
51
|
+
class MySafeController < ApplicationController
|
|
52
|
+
allow_gets :all
|
|
53
|
+
end
|
|
54
|
+
|
|
55
|
+
The best (easiest to trace) way to whitelist a particular action is to add `allow_get :action` after its definition:
|
|
56
|
+
|
|
57
|
+
def index
|
|
58
|
+
[...]
|
|
59
|
+
end
|
|
60
|
+
allow_get :index
|
|
61
|
+
|
|
62
|
+
Alternatively you can whitelist all actions in the same place. For this include in your controller
|
|
63
|
+
|
|
64
|
+
allow_gets :only => [:action1, :action2]
|
|
65
|
+
|
|
66
|
+
There is also a simple way to do blacklisting instead of whitelisting (not recommended, as it is much less reliable):
|
|
67
|
+
|
|
68
|
+
allow_gets :except => [:action1, :action2]
|
|
69
|
+
|
|
70
|
+
### CSRF protection for GET actions
|
|
71
|
+
|
|
72
|
+
You can protect specific action from CSRF by specifying it as a `protected_get`. Such protection will automatically
|
|
73
|
+
whitelist corresponding action for GET requests.
|
|
74
|
+
|
|
75
|
+
def redirected
|
|
76
|
+
[...]
|
|
77
|
+
end
|
|
78
|
+
protected_get :redirected
|
|
79
|
+
|
|
80
|
+
When this action is called without `form_authenticity_token` as explicit parameter or in the header,
|
|
81
|
+
`handle_unverified_request` will be called (default Rails behavior is to clear session data)
|
|
82
|
+
|
|
83
|
+
You can add token as a parameter to your get request providing it explicitly
|
|
84
|
+
|
|
85
|
+
<%= link_to 'Protected get', some_defined_path(request_forgery_protection_token => form_authenticity_token) %>
|
|
86
|
+
|
|
87
|
+
Please be aware that `protected_get` adds its filter on top of filter chain to avoid potential side effects
|
|
88
|
+
of other filters. It means that none of subsequent filters that rely on session data will work if request is
|
|
89
|
+
not verified
|
|
90
|
+
|
data/Rakefile
ADDED
|
@@ -0,0 +1,35 @@
|
|
|
1
|
+
#!/usr/bin/env rake
|
|
2
|
+
begin
|
|
3
|
+
require 'bundler/setup'
|
|
4
|
+
rescue LoadError
|
|
5
|
+
puts 'You must `gem install bundler` and `bundle install` to run rake tasks'
|
|
6
|
+
end
|
|
7
|
+
begin
|
|
8
|
+
require 'rdoc/task'
|
|
9
|
+
rescue LoadError
|
|
10
|
+
require 'rdoc/rdoc'
|
|
11
|
+
require 'rake/rdoctask'
|
|
12
|
+
RDoc::Task = Rake::RDocTask
|
|
13
|
+
end
|
|
14
|
+
|
|
15
|
+
RDoc::Task.new(:rdoc) do |rdoc|
|
|
16
|
+
rdoc.rdoc_dir = 'rdoc'
|
|
17
|
+
rdoc.title = 'LastLine'
|
|
18
|
+
rdoc.options << '--line-numbers'
|
|
19
|
+
rdoc.rdoc_files.include('README.md')
|
|
20
|
+
rdoc.rdoc_files.include('lib/**/*.rb')
|
|
21
|
+
end
|
|
22
|
+
|
|
23
|
+
Bundler::GemHelper.install_tasks
|
|
24
|
+
|
|
25
|
+
require 'rake/testtask'
|
|
26
|
+
|
|
27
|
+
Rake::TestTask.new(:test) do |t|
|
|
28
|
+
t.libs << 'lib'
|
|
29
|
+
t.libs << 'test'
|
|
30
|
+
t.pattern = 'test/**/*_test.rb'
|
|
31
|
+
t.verbose = false
|
|
32
|
+
end
|
|
33
|
+
|
|
34
|
+
|
|
35
|
+
task :default => :test
|
|
@@ -0,0 +1,48 @@
|
|
|
1
|
+
require 'active_support/concern'
|
|
2
|
+
|
|
3
|
+
module LastLine
|
|
4
|
+
module Controller
|
|
5
|
+
extend ActiveSupport::Concern
|
|
6
|
+
|
|
7
|
+
module ClassMethods
|
|
8
|
+
##
|
|
9
|
+
# When added on
|
|
10
|
+
def protect_from_gets
|
|
11
|
+
append_before_filter :block_gets
|
|
12
|
+
end
|
|
13
|
+
|
|
14
|
+
def protected_get action
|
|
15
|
+
skip_before_filter :block_gets, :only => action
|
|
16
|
+
prepend_before_filter :protect_get, :only => action
|
|
17
|
+
end
|
|
18
|
+
|
|
19
|
+
def allow_get action
|
|
20
|
+
skip_before_filter :block_gets, :only => action
|
|
21
|
+
end
|
|
22
|
+
|
|
23
|
+
def allow_gets *args
|
|
24
|
+
skip_before_filter :block_gets, *args
|
|
25
|
+
end
|
|
26
|
+
end
|
|
27
|
+
|
|
28
|
+
protected
|
|
29
|
+
|
|
30
|
+
def protect_get
|
|
31
|
+
unless token_verified?
|
|
32
|
+
logger.warn "WARNING: Can't verify CSRF token authenticity" if logger
|
|
33
|
+
handle_unverified_request
|
|
34
|
+
end
|
|
35
|
+
end
|
|
36
|
+
|
|
37
|
+
def block_gets
|
|
38
|
+
return unless request.get?
|
|
39
|
+
head :status => :forbidden
|
|
40
|
+
end
|
|
41
|
+
|
|
42
|
+
def token_verified?
|
|
43
|
+
!protect_against_forgery? ||
|
|
44
|
+
form_authenticity_token == params[request_forgery_protection_token] ||
|
|
45
|
+
form_authenticity_token == request.headers['X-CSRF-Token']
|
|
46
|
+
end
|
|
47
|
+
end
|
|
48
|
+
end
|
|
@@ -0,0 +1,12 @@
|
|
|
1
|
+
require 'last_line'
|
|
2
|
+
require 'rails'
|
|
3
|
+
|
|
4
|
+
module LastLine
|
|
5
|
+
class Railtie < ::Rails::Railtie
|
|
6
|
+
initializer "last_line.action_controller" do |app|
|
|
7
|
+
ActiveSupport.on_load :action_controller do
|
|
8
|
+
ActionController::Base.send :include, Controller
|
|
9
|
+
end
|
|
10
|
+
end
|
|
11
|
+
end
|
|
12
|
+
end
|
data/lib/last_line.rb
ADDED
|
@@ -0,0 +1,463 @@
|
|
|
1
|
+
Processing by ProtectedController#explicitly as HTML
|
|
2
|
+
Filter chain halted as #<Proc:0x007f82da8046c0@/Users/eugeneka/Projects/last_line/test/protected_controller_test.rb:5 (lambda)> rendered or redirected
|
|
3
|
+
Completed 200 OK in 0ms
|
|
4
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
5
|
+
Filter chain halted as #<Proc:0x007f82da8046c0@/Users/eugeneka/Projects/last_line/test/protected_controller_test.rb:5 (lambda)> rendered or redirected
|
|
6
|
+
Completed 200 OK in 0ms
|
|
7
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
8
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
9
|
+
Completed 403 Forbidden in 0ms
|
|
10
|
+
Processing by ProtectedController#explicitly as HTML
|
|
11
|
+
Filter chain halted as #<Proc:0x007fc9cc44ab18@/Users/eugeneka/Projects/last_line/test/protected_controller_test.rb:5 (lambda)> rendered or redirected
|
|
12
|
+
Completed 200 OK in 0ms
|
|
13
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
14
|
+
Filter chain halted as #<Proc:0x007fc9cc44ab18@/Users/eugeneka/Projects/last_line/test/protected_controller_test.rb:5 (lambda)> rendered or redirected
|
|
15
|
+
Completed 200 OK in 0ms
|
|
16
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
17
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
18
|
+
Completed 403 Forbidden in 0ms
|
|
19
|
+
Processing by ProtectedController#explicitly as HTML
|
|
20
|
+
Filter chain halted as #<Proc:0x007f87fecbd850@/Users/eugeneka/Projects/last_line/test/protected_controller_test.rb:5 (lambda)> rendered or redirected
|
|
21
|
+
Completed 200 OK in 0ms
|
|
22
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
23
|
+
Filter chain halted as #<Proc:0x007f87fecbd850@/Users/eugeneka/Projects/last_line/test/protected_controller_test.rb:5 (lambda)> rendered or redirected
|
|
24
|
+
Completed 200 OK in 0ms
|
|
25
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
26
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
27
|
+
Completed 403 Forbidden in 0ms
|
|
28
|
+
Processing by ProtectedController#explicitly as HTML
|
|
29
|
+
Filter chain halted as #<Proc:0x007f94d4c85ee0@/Users/eugeneka/Projects/last_line/test/protected_controller_test.rb:5 (lambda)> rendered or redirected
|
|
30
|
+
Completed 200 OK in 0ms
|
|
31
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
32
|
+
Filter chain halted as #<Proc:0x007f94d4c85ee0@/Users/eugeneka/Projects/last_line/test/protected_controller_test.rb:5 (lambda)> rendered or redirected
|
|
33
|
+
Completed 200 OK in 0ms
|
|
34
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
35
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
36
|
+
Completed 403 Forbidden in 0ms
|
|
37
|
+
Processing by ProtectedController#explicitly as HTML
|
|
38
|
+
Filter chain halted as #<Proc:0x007fc1a2bb4f20@/Users/eugeneka/Projects/last_line/test/protected_controller_test.rb:5 (lambda)> rendered or redirected
|
|
39
|
+
Completed 200 OK in 0ms
|
|
40
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
41
|
+
Filter chain halted as #<Proc:0x007fc1a2bb4f20@/Users/eugeneka/Projects/last_line/test/protected_controller_test.rb:5 (lambda)> rendered or redirected
|
|
42
|
+
Completed 200 OK in 0ms
|
|
43
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
44
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
45
|
+
Completed 403 Forbidden in 0ms
|
|
46
|
+
Processing by ProtectedController#explicitly as HTML
|
|
47
|
+
Filter chain halted as #<Proc:0x007fdf39899ea8@/Users/eugeneka/Projects/last_line/test/protected_controller_test.rb:5 (lambda)> rendered or redirected
|
|
48
|
+
Completed 200 OK in 0ms
|
|
49
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
50
|
+
Filter chain halted as #<Proc:0x007fdf39899ea8@/Users/eugeneka/Projects/last_line/test/protected_controller_test.rb:5 (lambda)> rendered or redirected
|
|
51
|
+
Completed 200 OK in 0ms
|
|
52
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
53
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
54
|
+
Completed 403 Forbidden in 0ms
|
|
55
|
+
Processing by ProtectedController#protected_get as HTML
|
|
56
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
57
|
+
Completed 403 Forbidden in 0ms
|
|
58
|
+
Processing by ProtectedController#explicitly as HTML
|
|
59
|
+
Filter chain halted as #<Proc:0x007fbc7fa16920@/Users/eugeneka/Projects/last_line/test/protected_controller_test.rb:5 (lambda)> rendered or redirected
|
|
60
|
+
Completed 200 OK in 0ms
|
|
61
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
62
|
+
Filter chain halted as #<Proc:0x007fbc7fa16920@/Users/eugeneka/Projects/last_line/test/protected_controller_test.rb:5 (lambda)> rendered or redirected
|
|
63
|
+
Completed 200 OK in 0ms
|
|
64
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
65
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
66
|
+
Completed 403 Forbidden in 0ms
|
|
67
|
+
Processing by ProtectedController#protected_get as HTML
|
|
68
|
+
Filter chain halted as #<Proc:0x007fbc7fa16920@/Users/eugeneka/Projects/last_line/test/protected_controller_test.rb:5 (lambda)> rendered or redirected
|
|
69
|
+
Completed 200 OK in 0ms
|
|
70
|
+
Processing by ProtectedController#explicitly as HTML
|
|
71
|
+
Filter chain halted as #<Proc:0x007ff4b6e640f8@/Users/eugeneka/Projects/last_line/test/protected_controller_test.rb:5 (lambda)> rendered or redirected
|
|
72
|
+
Completed 200 OK in 0ms
|
|
73
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
74
|
+
Filter chain halted as #<Proc:0x007ff4b6e640f8@/Users/eugeneka/Projects/last_line/test/protected_controller_test.rb:5 (lambda)> rendered or redirected
|
|
75
|
+
Completed 200 OK in 0ms
|
|
76
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
77
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
78
|
+
Completed 403 Forbidden in 0ms
|
|
79
|
+
Processing by ProtectedController#protected_get as HTML
|
|
80
|
+
Filter chain halted as #<Proc:0x007ff4b6e640f8@/Users/eugeneka/Projects/last_line/test/protected_controller_test.rb:5 (lambda)> rendered or redirected
|
|
81
|
+
Completed 200 OK in 0ms
|
|
82
|
+
Processing by ProtectedController#explicitly as HTML
|
|
83
|
+
Filter chain halted as #<Proc:0x007fcb67f352e8@/Users/eugeneka/Projects/last_line/test/protected_controller_test.rb:5 (lambda)> rendered or redirected
|
|
84
|
+
Completed 200 OK in 0ms
|
|
85
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
86
|
+
Filter chain halted as #<Proc:0x007fcb67f352e8@/Users/eugeneka/Projects/last_line/test/protected_controller_test.rb:5 (lambda)> rendered or redirected
|
|
87
|
+
Completed 200 OK in 0ms
|
|
88
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
89
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
90
|
+
Completed 403 Forbidden in 0ms
|
|
91
|
+
Processing by ProtectedController#protected_get as HTML
|
|
92
|
+
Filter chain halted as #<Proc:0x007fcb67f352e8@/Users/eugeneka/Projects/last_line/test/protected_controller_test.rb:5 (lambda)> rendered or redirected
|
|
93
|
+
Completed 200 OK in 0ms
|
|
94
|
+
Processing by ProtectedController#explicitly as HTML
|
|
95
|
+
Filter chain halted as #<Proc:0x007fa25bc54b58@/Users/eugeneka/Projects/last_line/test/protected_controller_test.rb:5 (lambda)> rendered or redirected
|
|
96
|
+
Completed 200 OK in 0ms
|
|
97
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
98
|
+
Filter chain halted as #<Proc:0x007fa25bc54b58@/Users/eugeneka/Projects/last_line/test/protected_controller_test.rb:5 (lambda)> rendered or redirected
|
|
99
|
+
Completed 200 OK in 0ms
|
|
100
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
101
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
102
|
+
Completed 403 Forbidden in 0ms
|
|
103
|
+
Processing by ProtectedController#protected_get as HTML
|
|
104
|
+
Filter chain halted as #<Proc:0x007fa25bc54b58@/Users/eugeneka/Projects/last_line/test/protected_controller_test.rb:5 (lambda)> rendered or redirected
|
|
105
|
+
Completed 200 OK in 0ms
|
|
106
|
+
Processing by ProtectedController#explicitly as HTML
|
|
107
|
+
Completed 200 OK in 0ms
|
|
108
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
109
|
+
Completed 200 OK in 0ms
|
|
110
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
111
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
112
|
+
Completed 403 Forbidden in 0ms
|
|
113
|
+
Processing by ProtectedController#protected_get as HTML
|
|
114
|
+
Completed 500 Internal Server Error in 0ms
|
|
115
|
+
Processing by ProtectedController#explicitly as HTML
|
|
116
|
+
Completed 200 OK in 0ms
|
|
117
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
118
|
+
Completed 200 OK in 0ms
|
|
119
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
120
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
121
|
+
Completed 403 Forbidden in 0ms
|
|
122
|
+
Processing by ProtectedController#protected_get as HTML
|
|
123
|
+
WARNING: Can't verify CSRF token authenticity
|
|
124
|
+
Completed 200 OK in 0ms
|
|
125
|
+
Processing by ProtectedController#explicitly as HTML
|
|
126
|
+
Completed 200 OK in 0ms
|
|
127
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
128
|
+
Completed 200 OK in 0ms
|
|
129
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
130
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
131
|
+
Completed 403 Forbidden in 0ms
|
|
132
|
+
Processing by ProtectedController#protected_get as HTML
|
|
133
|
+
WARNING: Can't verify CSRF token authenticity
|
|
134
|
+
Completed 200 OK in 0ms
|
|
135
|
+
Processing by ProtectedController#explicitly as HTML
|
|
136
|
+
Parameters: {"user"=>"42"}
|
|
137
|
+
Completed 200 OK in 0ms
|
|
138
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
139
|
+
Completed 200 OK in 0ms
|
|
140
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
141
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
142
|
+
Completed 403 Forbidden in 0ms
|
|
143
|
+
Processing by ProtectedController#protected_get as HTML
|
|
144
|
+
Parameters: {"user"=>"42"}
|
|
145
|
+
WARNING: Can't verify CSRF token authenticity
|
|
146
|
+
Completed 200 OK in 0ms
|
|
147
|
+
Processing by ProtectedController#explicitly as HTML
|
|
148
|
+
Completed 200 OK in 0ms
|
|
149
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
150
|
+
Completed 200 OK in 0ms
|
|
151
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
152
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
153
|
+
Completed 403 Forbidden in 0ms
|
|
154
|
+
Processing by ProtectedController#protected_get as HTML
|
|
155
|
+
WARNING: Can't verify CSRF token authenticity
|
|
156
|
+
Completed 200 OK in 0ms
|
|
157
|
+
Processing by ProtectedController#explicitly as HTML
|
|
158
|
+
Completed 200 OK in 0ms
|
|
159
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
160
|
+
Completed 200 OK in 0ms
|
|
161
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
162
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
163
|
+
Completed 403 Forbidden in 0ms
|
|
164
|
+
Processing by ProtectedController#protected_get as HTML
|
|
165
|
+
WARNING: Can't verify CSRF token authenticity
|
|
166
|
+
Completed 200 OK in 0ms
|
|
167
|
+
Processing by ProtectedController#explicitly as HTML
|
|
168
|
+
Completed 200 OK in 0ms
|
|
169
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
170
|
+
Completed 200 OK in 0ms
|
|
171
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
172
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
173
|
+
Completed 403 Forbidden in 0ms
|
|
174
|
+
Processing by ProtectedController#protected_get as HTML
|
|
175
|
+
WARNING: Can't verify CSRF token authenticity
|
|
176
|
+
Completed 200 OK in 0ms
|
|
177
|
+
Processing by ProtectedController#explicitly as HTML
|
|
178
|
+
Completed 200 OK in 0ms
|
|
179
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
180
|
+
Completed 200 OK in 0ms
|
|
181
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
182
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
183
|
+
Completed 403 Forbidden in 0ms
|
|
184
|
+
Processing by ProtectedController#protected_get as HTML
|
|
185
|
+
WARNING: Can't verify CSRF token authenticity
|
|
186
|
+
Completed 200 OK in 0ms
|
|
187
|
+
Processing by ProtectedController#explicitly as HTML
|
|
188
|
+
Completed 200 OK in 0ms
|
|
189
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
190
|
+
Completed 200 OK in 0ms
|
|
191
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
192
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
193
|
+
Completed 403 Forbidden in 0ms
|
|
194
|
+
Processing by ProtectedController#protected_get as HTML
|
|
195
|
+
WARNING: Can't verify CSRF token authenticity
|
|
196
|
+
Completed 200 OK in 0ms
|
|
197
|
+
Processing by ProtectedController#explicitly as HTML
|
|
198
|
+
Completed 200 OK in 0ms
|
|
199
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
200
|
+
Completed 200 OK in 0ms
|
|
201
|
+
Processing by ProtectedController#protected_get as HTML
|
|
202
|
+
Parameters: {"authenticity_token"=>"HRPJ9cJcUE3XmwKV0lmsZhbMSKba8WQQrlLmK3aeDHw="}
|
|
203
|
+
WARNING: Can't verify CSRF token authenticity
|
|
204
|
+
Completed 200 OK in 0ms
|
|
205
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
206
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
207
|
+
Completed 403 Forbidden in 0ms
|
|
208
|
+
Processing by ProtectedController#protected_get as HTML
|
|
209
|
+
WARNING: Can't verify CSRF token authenticity
|
|
210
|
+
Completed 200 OK in 0ms
|
|
211
|
+
Processing by ProtectedController#explicitly as HTML
|
|
212
|
+
Completed 200 OK in 0ms
|
|
213
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
214
|
+
Completed 200 OK in 0ms
|
|
215
|
+
Processing by ProtectedController#protected_get as HTML
|
|
216
|
+
Parameters: {"authenticity_token"=>"eVL1Xq4Iu4c/U87DUvG8/M9kziqzGyf27GBCbTh1oF8="}
|
|
217
|
+
Completed 500 Internal Server Error in 1ms
|
|
218
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
219
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
220
|
+
Completed 403 Forbidden in 0ms
|
|
221
|
+
Processing by ProtectedController#protected_get as HTML
|
|
222
|
+
Completed 500 Internal Server Error in 1ms
|
|
223
|
+
Processing by ProtectedController#explicitly as HTML
|
|
224
|
+
Completed 200 OK in 0ms
|
|
225
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
226
|
+
Completed 200 OK in 0ms
|
|
227
|
+
Processing by ProtectedController#protected_get as HTML
|
|
228
|
+
Parameters: {"authenticity_token"=>"cWWJ/B2k3oBhfJVHs3h/zG9gY2MskVaL3uLHusvWPfk="}
|
|
229
|
+
WARNING: Can't verify CSRF token authenticity
|
|
230
|
+
Completed 200 OK in 0ms
|
|
231
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
232
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
233
|
+
Completed 403 Forbidden in 0ms
|
|
234
|
+
Processing by ProtectedController#protected_get as HTML
|
|
235
|
+
WARNING: Can't verify CSRF token authenticity
|
|
236
|
+
Completed 200 OK in 0ms
|
|
237
|
+
Processing by ProtectedController#explicitly as HTML
|
|
238
|
+
Completed 200 OK in 0ms
|
|
239
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
240
|
+
Completed 200 OK in 0ms
|
|
241
|
+
Processing by ProtectedController#protected_get as HTML
|
|
242
|
+
Parameters: {"authenticity_token"=>"dSihlQMk1PtnG6bn1j/5EWuyNx/nO76ze0F5F63YVJ0="}
|
|
243
|
+
WARNING: Can't verify CSRF token authenticity
|
|
244
|
+
Completed 200 OK in 0ms
|
|
245
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
246
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
247
|
+
Completed 403 Forbidden in 0ms
|
|
248
|
+
Processing by ProtectedController#protected_get as HTML
|
|
249
|
+
WARNING: Can't verify CSRF token authenticity
|
|
250
|
+
Completed 200 OK in 0ms
|
|
251
|
+
Processing by ProtectedController#explicitly as HTML
|
|
252
|
+
Completed 200 OK in 0ms
|
|
253
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
254
|
+
Completed 200 OK in 0ms
|
|
255
|
+
Processing by ProtectedController#protected_get as HTML
|
|
256
|
+
Parameters: {"authenticity_token"=>"nOg570TE6LvoIfe1tEaWlMXkjY1iEbdm+E8R4jjb+ZE="}
|
|
257
|
+
WARNING: Can't verify CSRF token authenticity
|
|
258
|
+
Completed 200 OK in 1ms
|
|
259
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
260
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
261
|
+
Completed 403 Forbidden in 0ms
|
|
262
|
+
Processing by ProtectedController#protected_get as HTML
|
|
263
|
+
WARNING: Can't verify CSRF token authenticity
|
|
264
|
+
Completed 200 OK in 0ms
|
|
265
|
+
Processing by ProtectedController#explicitly as HTML
|
|
266
|
+
Completed 200 OK in 0ms
|
|
267
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
268
|
+
Completed 200 OK in 0ms
|
|
269
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
270
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
271
|
+
Completed 403 Forbidden in 0ms
|
|
272
|
+
Processing by ProtectedController#protected_get as HTML
|
|
273
|
+
WARNING: Can't verify CSRF token authenticity
|
|
274
|
+
Completed 200 OK in 0ms
|
|
275
|
+
Processing by ProtectedController#explicitly as HTML
|
|
276
|
+
Completed 200 OK in 0ms
|
|
277
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
278
|
+
Completed 200 OK in 0ms
|
|
279
|
+
Processing by ProtectedController#protected_get as HTML
|
|
280
|
+
Parameters: {"authenticity_token"=>"token"}
|
|
281
|
+
Completed 200 OK in 0ms
|
|
282
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
283
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
284
|
+
Completed 403 Forbidden in 0ms
|
|
285
|
+
Processing by ProtectedController#protected_get as HTML
|
|
286
|
+
WARNING: Can't verify CSRF token authenticity
|
|
287
|
+
Completed 200 OK in 0ms
|
|
288
|
+
Processing by ProtectedController#explicitly as HTML
|
|
289
|
+
Completed 200 OK in 0ms
|
|
290
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
291
|
+
Completed 200 OK in 0ms
|
|
292
|
+
Processing by ProtectedController#protected_get as HTML
|
|
293
|
+
Parameters: {"authenticity_token"=>"token"}
|
|
294
|
+
Completed 200 OK in 0ms
|
|
295
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
296
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
297
|
+
Completed 403 Forbidden in 0ms
|
|
298
|
+
Processing by ProtectedController#protected_get as HTML
|
|
299
|
+
WARNING: Can't verify CSRF token authenticity
|
|
300
|
+
Completed 200 OK in 0ms
|
|
301
|
+
Processing by ProtectedController#explicitly as HTML
|
|
302
|
+
Completed 200 OK in 0ms
|
|
303
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
304
|
+
Completed 200 OK in 0ms
|
|
305
|
+
Processing by ProtectedController#protected_get as HTML
|
|
306
|
+
Parameters: {"authenticity_token"=>"token"}
|
|
307
|
+
Completed 200 OK in 0ms
|
|
308
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
309
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
310
|
+
Completed 403 Forbidden in 0ms
|
|
311
|
+
Processing by ProtectedController#protected_get as HTML
|
|
312
|
+
WARNING: Can't verify CSRF token authenticity
|
|
313
|
+
Completed 200 OK in 0ms
|
|
314
|
+
Processing by ProtectedController#explicitly as HTML
|
|
315
|
+
Completed 200 OK in 0ms
|
|
316
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
317
|
+
Completed 200 OK in 0ms
|
|
318
|
+
Processing by ProtectedController#protected_get as HTML
|
|
319
|
+
Parameters: {"authenticity_token"=>"token"}
|
|
320
|
+
Completed 200 OK in 0ms
|
|
321
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
322
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
323
|
+
Completed 403 Forbidden in 0ms
|
|
324
|
+
Processing by ProtectedController#protected_get as HTML
|
|
325
|
+
WARNING: Can't verify CSRF token authenticity
|
|
326
|
+
Completed 200 OK in 0ms
|
|
327
|
+
Processing by ProtectedController#explicitly as HTML
|
|
328
|
+
Completed 200 OK in 0ms
|
|
329
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
330
|
+
Completed 200 OK in 0ms
|
|
331
|
+
Processing by ProtectedController#protected_get as HTML
|
|
332
|
+
Parameters: {"authenticity_token"=>"token"}
|
|
333
|
+
Completed 200 OK in 0ms
|
|
334
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
335
|
+
Completed 200 OK in 0ms
|
|
336
|
+
Processing by ProtectedController#protected_get as HTML
|
|
337
|
+
WARNING: Can't verify CSRF token authenticity
|
|
338
|
+
Completed 200 OK in 0ms
|
|
339
|
+
Processing by ProtectedController#explicitly as HTML
|
|
340
|
+
Completed 200 OK in 0ms
|
|
341
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
342
|
+
Completed 200 OK in 0ms
|
|
343
|
+
Processing by ProtectedController#my_protected_get as HTML
|
|
344
|
+
Parameters: {"authenticity_token"=>"token"}
|
|
345
|
+
Completed 200 OK in 0ms
|
|
346
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
347
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
348
|
+
Completed 403 Forbidden in 0ms
|
|
349
|
+
Processing by ProtectedController#explicitly as HTML
|
|
350
|
+
Completed 200 OK in 0ms
|
|
351
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
352
|
+
Completed 200 OK in 0ms
|
|
353
|
+
Processing by ProtectedController#my_protected_get as HTML
|
|
354
|
+
Parameters: {"authenticity_token"=>"token"}
|
|
355
|
+
Completed 200 OK in 0ms
|
|
356
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
357
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
358
|
+
Completed 403 Forbidden in 0ms
|
|
359
|
+
Processing by ProtectedController#explicitly as HTML
|
|
360
|
+
Completed 200 OK in 0ms
|
|
361
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
362
|
+
Completed 200 OK in 0ms
|
|
363
|
+
Processing by ProtectedController#my_protected_get as HTML
|
|
364
|
+
Parameters: {"authenticity_token"=>"token"}
|
|
365
|
+
Completed 200 OK in 0ms
|
|
366
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
367
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
368
|
+
Completed 403 Forbidden in 0ms
|
|
369
|
+
Processing by ProtectedController#explicitly as HTML
|
|
370
|
+
Completed 200 OK in 0ms
|
|
371
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
372
|
+
Completed 200 OK in 0ms
|
|
373
|
+
Processing by ProtectedController#my_protected_get as HTML
|
|
374
|
+
Parameters: {"authenticity_token"=>"token"}
|
|
375
|
+
Completed 200 OK in 0ms
|
|
376
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
377
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
378
|
+
Completed 403 Forbidden in 0ms
|
|
379
|
+
Processing by ProtectedController#explicitly as HTML
|
|
380
|
+
Completed 200 OK in 0ms
|
|
381
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
382
|
+
Completed 200 OK in 0ms
|
|
383
|
+
Processing by ProtectedController#my_protected_get as HTML
|
|
384
|
+
Parameters: {"authenticity_token"=>"token"}
|
|
385
|
+
Completed 200 OK in 0ms
|
|
386
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
387
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
388
|
+
Completed 403 Forbidden in 0ms
|
|
389
|
+
Processing by ProtectedController#explicitly as HTML
|
|
390
|
+
Completed 200 OK in 0ms
|
|
391
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
392
|
+
Completed 200 OK in 0ms
|
|
393
|
+
Processing by ProtectedController#my_protected_get as HTML
|
|
394
|
+
Parameters: {"authenticity_token"=>"token"}
|
|
395
|
+
Completed 200 OK in 0ms
|
|
396
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
397
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
398
|
+
Completed 403 Forbidden in 0ms
|
|
399
|
+
Processing by ProtectedController#explicitly as HTML
|
|
400
|
+
Completed 200 OK in 0ms
|
|
401
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
402
|
+
Completed 200 OK in 0ms
|
|
403
|
+
Processing by ProtectedController#my_protected_get as HTML
|
|
404
|
+
Parameters: {"authenticity_token"=>"token"}
|
|
405
|
+
Completed 200 OK in 0ms
|
|
406
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
407
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
408
|
+
Completed 403 Forbidden in 0ms
|
|
409
|
+
Processing by ProtectedController#my_protected_get as HTML
|
|
410
|
+
WARNING: Can't verify CSRF token authenticity
|
|
411
|
+
Completed 200 OK in 0ms
|
|
412
|
+
Processing by ProtectedController#explicitly as HTML
|
|
413
|
+
Completed 200 OK in 0ms
|
|
414
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
415
|
+
Completed 200 OK in 0ms
|
|
416
|
+
Processing by ProtectedController#my_protected_get as HTML
|
|
417
|
+
Parameters: {"authenticity_token"=>"token"}
|
|
418
|
+
Completed 200 OK in 0ms
|
|
419
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
420
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
421
|
+
Completed 403 Forbidden in 0ms
|
|
422
|
+
Processing by ProtectedController#my_protected_get as HTML
|
|
423
|
+
WARNING: Can't verify CSRF token authenticity
|
|
424
|
+
Completed 200 OK in 0ms
|
|
425
|
+
Processing by ProtectedController#explicitly as HTML
|
|
426
|
+
Completed 200 OK in 0ms
|
|
427
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
428
|
+
Completed 200 OK in 0ms
|
|
429
|
+
Processing by ProtectedController#my_protected_get as HTML
|
|
430
|
+
Parameters: {"authenticity_token"=>"token"}
|
|
431
|
+
Completed 200 OK in 0ms
|
|
432
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
433
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
434
|
+
Completed 403 Forbidden in 0ms
|
|
435
|
+
Processing by ProtectedController#my_protected_get as HTML
|
|
436
|
+
WARNING: Can't verify CSRF token authenticity
|
|
437
|
+
Completed 200 OK in 0ms
|
|
438
|
+
Processing by ProtectedController#explicitly as HTML
|
|
439
|
+
Completed 200 OK in 0ms
|
|
440
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
441
|
+
Completed 200 OK in 0ms
|
|
442
|
+
Processing by ProtectedController#my_protected_get as HTML
|
|
443
|
+
Parameters: {"authenticity_token"=>"token"}
|
|
444
|
+
Completed 200 OK in 0ms
|
|
445
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
446
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
447
|
+
Completed 403 Forbidden in 0ms
|
|
448
|
+
Processing by ProtectedController#my_protected_get as HTML
|
|
449
|
+
WARNING: Can't verify CSRF token authenticity
|
|
450
|
+
Completed 200 OK in 0ms
|
|
451
|
+
Processing by ProtectedController#explicitly as HTML
|
|
452
|
+
Completed 200 OK in 0ms
|
|
453
|
+
Processing by ProtectedController#allowed_gets as HTML
|
|
454
|
+
Completed 200 OK in 0ms
|
|
455
|
+
Processing by ProtectedController#my_protected_get as HTML
|
|
456
|
+
Parameters: {"authenticity_token"=>"token"}
|
|
457
|
+
Completed 200 OK in 0ms
|
|
458
|
+
Processing by ProtectedController#not_allowed as HTML
|
|
459
|
+
Filter chain halted as :block_gets rendered or redirected
|
|
460
|
+
Completed 403 Forbidden in 0ms
|
|
461
|
+
Processing by ProtectedController#my_protected_get as HTML
|
|
462
|
+
WARNING: Can't verify CSRF token authenticity
|
|
463
|
+
Completed 200 OK in 0ms
|
|
@@ -0,0 +1,49 @@
|
|
|
1
|
+
require 'test_helper'
|
|
2
|
+
|
|
3
|
+
class ProtectedController < ApplicationController
|
|
4
|
+
protect_from_gets
|
|
5
|
+
allow_gets :only => :allowed_gets
|
|
6
|
+
|
|
7
|
+
def not_allowed() head(200) end
|
|
8
|
+
|
|
9
|
+
def explicitly() head(200) end
|
|
10
|
+
allow_get :explicitly
|
|
11
|
+
|
|
12
|
+
def allowed_gets() head(200) end
|
|
13
|
+
|
|
14
|
+
def my_protected_get() head(200) end
|
|
15
|
+
protected_get :my_protected_get
|
|
16
|
+
|
|
17
|
+
# stub token and make it accessible
|
|
18
|
+
def form_authenticity_token() 'token' end
|
|
19
|
+
end
|
|
20
|
+
|
|
21
|
+
class ProtectedControllerTest < ActionController::TestCase
|
|
22
|
+
test 'should prevent get' do
|
|
23
|
+
get :not_allowed
|
|
24
|
+
assert_response :forbidden
|
|
25
|
+
end
|
|
26
|
+
|
|
27
|
+
test 'should allow explict get' do
|
|
28
|
+
get :explicitly, nil, {:user => 42}
|
|
29
|
+
assert_response :success
|
|
30
|
+
assert_equal 42, session[:user]
|
|
31
|
+
end
|
|
32
|
+
|
|
33
|
+
test 'should allow_gets' do
|
|
34
|
+
get :allowed_gets
|
|
35
|
+
assert_response :success
|
|
36
|
+
end
|
|
37
|
+
|
|
38
|
+
test 'should protect get' do
|
|
39
|
+
get :my_protected_get, nil, {:user => 42}
|
|
40
|
+
assert_response :success
|
|
41
|
+
assert_nil session[:user]
|
|
42
|
+
end
|
|
43
|
+
|
|
44
|
+
test 'should allow protected get with token' do
|
|
45
|
+
get :my_protected_get, {@controller.request_forgery_protection_token => 'token'}, {:user => 42}
|
|
46
|
+
assert_response :success
|
|
47
|
+
assert_equal 42, session[:user]
|
|
48
|
+
end
|
|
49
|
+
end
|
data/test/test_helper.rb
ADDED
metadata
ADDED
|
@@ -0,0 +1,88 @@
|
|
|
1
|
+
--- !ruby/object:Gem::Specification
|
|
2
|
+
name: last_line
|
|
3
|
+
version: !ruby/object:Gem::Version
|
|
4
|
+
version: 0.0.1
|
|
5
|
+
prerelease:
|
|
6
|
+
platform: ruby
|
|
7
|
+
authors:
|
|
8
|
+
- Eugene Kalenkovich
|
|
9
|
+
autorequire:
|
|
10
|
+
bindir: bin
|
|
11
|
+
cert_chain: []
|
|
12
|
+
date: 2013-03-10 00:00:00.000000000 Z
|
|
13
|
+
dependencies:
|
|
14
|
+
- !ruby/object:Gem::Dependency
|
|
15
|
+
name: rails
|
|
16
|
+
requirement: !ruby/object:Gem::Requirement
|
|
17
|
+
none: false
|
|
18
|
+
requirements:
|
|
19
|
+
- - ~>
|
|
20
|
+
- !ruby/object:Gem::Version
|
|
21
|
+
version: '3.1'
|
|
22
|
+
type: :runtime
|
|
23
|
+
prerelease: false
|
|
24
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
25
|
+
none: false
|
|
26
|
+
requirements:
|
|
27
|
+
- - ~>
|
|
28
|
+
- !ruby/object:Gem::Version
|
|
29
|
+
version: '3.1'
|
|
30
|
+
description: Explicitly allow GET requests for specific actions, verify authenticity
|
|
31
|
+
token on GET
|
|
32
|
+
email:
|
|
33
|
+
- rubify@softover.com
|
|
34
|
+
executables: []
|
|
35
|
+
extensions: []
|
|
36
|
+
extra_rdoc_files: []
|
|
37
|
+
files:
|
|
38
|
+
- lib/last_line/controller.rb
|
|
39
|
+
- lib/last_line/railtie.rb
|
|
40
|
+
- lib/last_line/version.rb
|
|
41
|
+
- lib/last_line.rb
|
|
42
|
+
- MIT-LICENSE
|
|
43
|
+
- Rakefile
|
|
44
|
+
- README.md
|
|
45
|
+
- test/dummy/app/controllers/application_controller.rb
|
|
46
|
+
- test/dummy/config/application.rb
|
|
47
|
+
- test/dummy/config/boot.rb
|
|
48
|
+
- test/dummy/config/environment.rb
|
|
49
|
+
- test/dummy/config/routes.rb
|
|
50
|
+
- test/dummy/config.ru
|
|
51
|
+
- test/dummy/log/test.log
|
|
52
|
+
- test/protected_controller_test.rb
|
|
53
|
+
- test/test_helper.rb
|
|
54
|
+
homepage: https://github.com/kalenkov/last_line
|
|
55
|
+
licenses: []
|
|
56
|
+
post_install_message:
|
|
57
|
+
rdoc_options: []
|
|
58
|
+
require_paths:
|
|
59
|
+
- lib
|
|
60
|
+
required_ruby_version: !ruby/object:Gem::Requirement
|
|
61
|
+
none: false
|
|
62
|
+
requirements:
|
|
63
|
+
- - ! '>='
|
|
64
|
+
- !ruby/object:Gem::Version
|
|
65
|
+
version: '0'
|
|
66
|
+
required_rubygems_version: !ruby/object:Gem::Requirement
|
|
67
|
+
none: false
|
|
68
|
+
requirements:
|
|
69
|
+
- - ! '>='
|
|
70
|
+
- !ruby/object:Gem::Version
|
|
71
|
+
version: '0'
|
|
72
|
+
requirements: []
|
|
73
|
+
rubyforge_project:
|
|
74
|
+
rubygems_version: 1.8.24
|
|
75
|
+
signing_key:
|
|
76
|
+
specification_version: 3
|
|
77
|
+
summary: Last line of CSRF defence in your controllers
|
|
78
|
+
test_files:
|
|
79
|
+
- test/dummy/app/controllers/application_controller.rb
|
|
80
|
+
- test/dummy/config/application.rb
|
|
81
|
+
- test/dummy/config/boot.rb
|
|
82
|
+
- test/dummy/config/environment.rb
|
|
83
|
+
- test/dummy/config/routes.rb
|
|
84
|
+
- test/dummy/config.ru
|
|
85
|
+
- test/dummy/log/test.log
|
|
86
|
+
- test/protected_controller_test.rb
|
|
87
|
+
- test/test_helper.rb
|
|
88
|
+
has_rdoc:
|