limited_sessions 5.0.2 → 5.0.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG +4 -0
- data/{MIT-LICENSE → LICENSE.txt} +1 -1
- data/README.md +1 -1
- data/lib/limited_sessions/version.rb +1 -1
- data/test/dummy/bin/rails +4 -0
- data/test/dummy/bin/rake +4 -0
- data/test/dummy/bin/setup +33 -0
- data/test/dummy/config/application.rb +19 -51
- data/test/dummy/config/boot.rb +2 -9
- data/test/dummy/config/cable.yml +10 -0
- data/test/dummy/config/environment.rb +4 -4
- data/test/dummy/config/environments/development.rb +60 -23
- data/test/dummy/config/environments/production.rb +65 -41
- data/test/dummy/config/environments/test.rb +49 -22
- data/test/dummy/config/initializers/content_security_policy.rb +25 -0
- data/test/dummy/config/initializers/filter_parameter_logging.rb +8 -0
- data/test/dummy/config/initializers/inflections.rb +10 -9
- data/test/dummy/config/initializers/permissions_policy.rb +13 -0
- data/test/dummy/config/storage.yml +34 -0
- data/test/dummy/db/test.sqlite3 +0 -0
- data/test/dummy/log/development.log +0 -0
- data/test/dummy/log/test.log +32 -0
- data/test/dummy/tmp/local_secret.txt +1 -0
- metadata +34 -10
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 65059f086893d3755e625fb246977babadb661460abe84e13b40f17b88af382d
|
4
|
+
data.tar.gz: 5c49dd22c9522a12dd792849b53f8223e973b15189438a57fc9286c027c28371
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: c6bb883c21b9a43601d5e3398fe528b8c11d2636c30faecdea7036c131e63e024fcf021ad45db138009909ce56aa037a5b2e2d3b24b657817cc3c3467204d594
|
7
|
+
data.tar.gz: bc0dc120dea9671b9aafb3e3174728abc83b950ce9d65005e8885756866fedfe3f35dd89080b6f70ad77cb9ba03cd2357f7449a0f7050f0f1e234c2b623824a7
|
data/CHANGELOG
CHANGED
data/{MIT-LICENSE → LICENSE.txt}
RENAMED
data/README.md
CHANGED
@@ -31,7 +31,7 @@ LimitedSessions provides two distinct features, each in a separate part:
|
|
31
31
|
|
32
32
|
## Compatibility
|
33
33
|
|
34
|
-
The middleware should be compatible with any framework using a recent version of Rack. It has been tested with Rack 2-3 and Rails 5.2-7.
|
34
|
+
The middleware should be compatible with any framework using a recent version of Rack. It has been tested with Rack 2-3 and Rails 5.2-7.2.
|
35
35
|
|
36
36
|
The optional ActiveRecord Session Store extension requires Rails.
|
37
37
|
|
data/test/dummy/bin/rake
ADDED
@@ -0,0 +1,33 @@
|
|
1
|
+
#!/usr/bin/env ruby
|
2
|
+
require "fileutils"
|
3
|
+
|
4
|
+
# path to your application root.
|
5
|
+
APP_ROOT = File.expand_path("..", __dir__)
|
6
|
+
|
7
|
+
def system!(*args)
|
8
|
+
system(*args, exception: true)
|
9
|
+
end
|
10
|
+
|
11
|
+
FileUtils.chdir APP_ROOT do
|
12
|
+
# This script is a way to set up or update your development environment automatically.
|
13
|
+
# This script is idempotent, so that you can run it at any time and get an expectable outcome.
|
14
|
+
# Add necessary setup steps to this file.
|
15
|
+
|
16
|
+
puts "== Installing dependencies =="
|
17
|
+
system! "gem install bundler --conservative"
|
18
|
+
system("bundle check") || system!("bundle install")
|
19
|
+
|
20
|
+
# puts "\n== Copying sample files =="
|
21
|
+
# unless File.exist?("config/database.yml")
|
22
|
+
# FileUtils.cp "config/database.yml.sample", "config/database.yml"
|
23
|
+
# end
|
24
|
+
|
25
|
+
puts "\n== Preparing database =="
|
26
|
+
system! "bin/rails db:prepare"
|
27
|
+
|
28
|
+
puts "\n== Removing old logs and tempfiles =="
|
29
|
+
system! "bin/rails log:clear tmp:clear"
|
30
|
+
|
31
|
+
puts "\n== Restarting application server =="
|
32
|
+
system! "bin/rails restart"
|
33
|
+
end
|
@@ -1,59 +1,27 @@
|
|
1
|
-
|
1
|
+
require_relative "boot"
|
2
2
|
|
3
|
-
require
|
3
|
+
require "rails/all"
|
4
4
|
|
5
|
-
|
5
|
+
# Require the gems listed in Gemfile, including any gems
|
6
|
+
# you've limited to :test, :development, or :production.
|
7
|
+
Bundler.require(*Rails.groups)
|
6
8
|
require "limited_sessions"
|
7
9
|
|
8
10
|
module Dummy
|
9
11
|
class Application < Rails::Application
|
10
|
-
|
11
|
-
|
12
|
-
#
|
13
|
-
|
14
|
-
#
|
15
|
-
|
16
|
-
|
17
|
-
#
|
18
|
-
#
|
19
|
-
#
|
20
|
-
|
21
|
-
#
|
22
|
-
# config.
|
23
|
-
|
24
|
-
# Set Time.zone default to the specified zone and make Active Record auto-convert to this zone.
|
25
|
-
# Run "rake -D time" for a list of tasks for finding time zone names. Default is UTC.
|
26
|
-
# config.time_zone = 'Central Time (US & Canada)'
|
27
|
-
|
28
|
-
# The default locale is :en and all translations from config/locales/*.rb,yml are auto loaded.
|
29
|
-
# config.i18n.load_path += Dir[Rails.root.join('my', 'locales', '*.{rb,yml}').to_s]
|
30
|
-
# config.i18n.default_locale = :de
|
31
|
-
|
32
|
-
# Configure the default encoding used in templates for Ruby 1.9.
|
33
|
-
config.encoding = "utf-8"
|
34
|
-
|
35
|
-
# Configure sensitive parameters which will be filtered from the log file.
|
36
|
-
config.filter_parameters += [:password]
|
37
|
-
|
38
|
-
# Enable escaping HTML in JSON.
|
39
|
-
config.active_support.escape_html_entities_in_json = true
|
40
|
-
|
41
|
-
# Use SQL instead of Active Record's schema dumper when creating the database.
|
42
|
-
# This is necessary if your schema can't be completely dumped by the schema dumper,
|
43
|
-
# like if you have constraints or database-specific column types
|
44
|
-
# config.active_record.schema_format = :sql
|
45
|
-
|
46
|
-
# Enforce whitelist mode for mass assignment.
|
47
|
-
# This will create an empty whitelist of attributes available for mass-assignment for all models
|
48
|
-
# in your app. As such, your models will need to explicitly whitelist or blacklist accessible
|
49
|
-
# parameters by using an attr_accessible or attr_protected declaration.
|
50
|
-
config.active_record.whitelist_attributes = true
|
51
|
-
|
52
|
-
# Enable the asset pipeline
|
53
|
-
config.assets.enabled = true
|
54
|
-
|
55
|
-
# Version of your assets, change this if you want to expire all your assets
|
56
|
-
config.assets.version = '1.0'
|
12
|
+
config.load_defaults Rails::VERSION::STRING.to_f
|
13
|
+
|
14
|
+
# Please, add to the `ignore` list any other `lib` subdirectories that do
|
15
|
+
# not contain `.rb` files, or that should not be reloaded or eager loaded.
|
16
|
+
# Common ones are `templates`, `generators`, or `middleware`, for example.
|
17
|
+
config.autoload_lib(ignore: %w(assets tasks))
|
18
|
+
|
19
|
+
# Configuration for the application, engines, and railties goes here.
|
20
|
+
#
|
21
|
+
# These settings can be overridden in specific environments using the files
|
22
|
+
# in config/environments, which are processed later.
|
23
|
+
#
|
24
|
+
# config.time_zone = "Central Time (US & Canada)"
|
25
|
+
# config.eager_load_paths << Rails.root.join("extras")
|
57
26
|
end
|
58
27
|
end
|
59
|
-
|
data/test/dummy/config/boot.rb
CHANGED
@@ -1,10 +1,3 @@
|
|
1
|
-
|
2
|
-
gemfile = File.expand_path('../../../../Gemfile', __FILE__)
|
1
|
+
ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../Gemfile", __dir__)
|
3
2
|
|
4
|
-
|
5
|
-
ENV['BUNDLE_GEMFILE'] = gemfile
|
6
|
-
require 'bundler'
|
7
|
-
Bundler.setup
|
8
|
-
end
|
9
|
-
|
10
|
-
$:.unshift File.expand_path('../../../../lib', __FILE__)
|
3
|
+
require "bundler/setup" # Set up gems listed in the Gemfile.
|
@@ -1,5 +1,5 @@
|
|
1
|
-
# Load the
|
2
|
-
|
1
|
+
# Load the Rails application.
|
2
|
+
require_relative "application"
|
3
3
|
|
4
|
-
# Initialize the
|
5
|
-
|
4
|
+
# Initialize the Rails application.
|
5
|
+
Rails.application.initialize!
|
@@ -1,37 +1,74 @@
|
|
1
|
-
|
2
|
-
# Settings specified here will take precedence over those in config/application.rb
|
1
|
+
require "active_support/core_ext/integer/time"
|
3
2
|
|
4
|
-
|
5
|
-
#
|
3
|
+
Rails.application.configure do
|
4
|
+
# Settings specified here will take precedence over those in config/application.rb.
|
5
|
+
|
6
|
+
# In the development environment your application's code is reloaded any time
|
7
|
+
# it changes. This slows down response time but is perfect for development
|
6
8
|
# since you don't have to restart the web server when you make code changes.
|
7
|
-
config.
|
9
|
+
config.enable_reloading = true
|
10
|
+
|
11
|
+
# Do not eager load code on boot.
|
12
|
+
config.eager_load = false
|
13
|
+
|
14
|
+
# Show full error reports.
|
15
|
+
config.consider_all_requests_local = true
|
16
|
+
|
17
|
+
# Enable server timing
|
18
|
+
config.server_timing = true
|
19
|
+
|
20
|
+
# Enable/disable caching. By default caching is disabled.
|
21
|
+
# Run rails dev:cache to toggle caching.
|
22
|
+
if Rails.root.join("tmp/caching-dev.txt").exist?
|
23
|
+
config.action_controller.perform_caching = true
|
24
|
+
config.action_controller.enable_fragment_cache_logging = true
|
25
|
+
|
26
|
+
config.cache_store = :memory_store
|
27
|
+
config.public_file_server.headers = {
|
28
|
+
"Cache-Control" => "public, max-age=#{2.days.to_i}"
|
29
|
+
}
|
30
|
+
else
|
31
|
+
config.action_controller.perform_caching = false
|
8
32
|
|
9
|
-
|
10
|
-
|
33
|
+
config.cache_store = :null_store
|
34
|
+
end
|
11
35
|
|
12
|
-
#
|
13
|
-
config.
|
14
|
-
config.action_controller.perform_caching = false
|
36
|
+
# Store uploaded files on the local file system (see config/storage.yml for options).
|
37
|
+
config.active_storage.service = :local
|
15
38
|
|
16
|
-
# Don't care if the mailer can't send
|
39
|
+
# Don't care if the mailer can't send.
|
17
40
|
config.action_mailer.raise_delivery_errors = false
|
18
41
|
|
19
|
-
|
42
|
+
config.action_mailer.perform_caching = false
|
43
|
+
|
44
|
+
# Print deprecation notices to the Rails logger.
|
20
45
|
config.active_support.deprecation = :log
|
21
46
|
|
22
|
-
#
|
23
|
-
config.
|
47
|
+
# Raise exceptions for disallowed deprecations.
|
48
|
+
config.active_support.disallowed_deprecation = :raise
|
49
|
+
|
50
|
+
# Tell Active Support which deprecation messages to disallow.
|
51
|
+
config.active_support.disallowed_deprecation_warnings = []
|
52
|
+
|
53
|
+
# Raise an error on page load if there are pending migrations.
|
54
|
+
config.active_record.migration_error = :page_load
|
55
|
+
|
56
|
+
# Highlight code that triggered database queries in logs.
|
57
|
+
config.active_record.verbose_query_logs = true
|
58
|
+
|
59
|
+
# Highlight code that enqueued background job in logs.
|
60
|
+
config.active_job.verbose_enqueue_logs = true
|
61
|
+
|
24
62
|
|
25
|
-
#
|
26
|
-
config.
|
63
|
+
# Raises error for missing translations.
|
64
|
+
# config.i18n.raise_on_missing_translations = true
|
27
65
|
|
28
|
-
#
|
29
|
-
#
|
30
|
-
config.active_record.auto_explain_threshold_in_seconds = 0.5
|
66
|
+
# Annotate rendered view with file names.
|
67
|
+
# config.action_view.annotate_rendered_view_with_filenames = true
|
31
68
|
|
32
|
-
#
|
33
|
-
config.
|
69
|
+
# Uncomment if you wish to allow Action Cable access from any origin.
|
70
|
+
# config.action_cable.disable_request_forgery_protection = true
|
34
71
|
|
35
|
-
#
|
36
|
-
config.
|
72
|
+
# Raise error when a before_action's only/except options reference missing actions
|
73
|
+
config.action_controller.raise_on_missing_callback_actions = true
|
37
74
|
end
|
@@ -1,67 +1,91 @@
|
|
1
|
-
|
2
|
-
# Settings specified here will take precedence over those in config/application.rb
|
1
|
+
require "active_support/core_ext/integer/time"
|
3
2
|
|
4
|
-
|
5
|
-
config.
|
3
|
+
Rails.application.configure do
|
4
|
+
# Settings specified here will take precedence over those in config/application.rb.
|
6
5
|
|
7
|
-
#
|
8
|
-
config.
|
6
|
+
# Code is not reloaded between requests.
|
7
|
+
config.enable_reloading = false
|
8
|
+
|
9
|
+
# Eager load code on boot. This eager loads most of Rails and
|
10
|
+
# your application in memory, allowing both threaded web servers
|
11
|
+
# and those relying on copy on write to perform better.
|
12
|
+
# Rake tasks automatically ignore this option for performance.
|
13
|
+
config.eager_load = true
|
14
|
+
|
15
|
+
# Full error reports are disabled and caching is turned on.
|
16
|
+
config.consider_all_requests_local = false
|
9
17
|
config.action_controller.perform_caching = true
|
10
18
|
|
11
|
-
#
|
12
|
-
config.
|
19
|
+
# Ensures that a master key has been made available in ENV["RAILS_MASTER_KEY"], config/master.key, or an environment
|
20
|
+
# key such as config/credentials/production.key. This key is used to decrypt credentials (and other encrypted files).
|
21
|
+
# config.require_master_key = true
|
22
|
+
|
23
|
+
# Disable serving static files from `public/`, relying on NGINX/Apache to do so instead.
|
24
|
+
# config.public_file_server.enabled = false
|
13
25
|
|
14
|
-
#
|
15
|
-
config.
|
26
|
+
# Enable serving of images, stylesheets, and JavaScripts from an asset server.
|
27
|
+
# config.asset_host = "http://assets.example.com"
|
16
28
|
|
17
|
-
#
|
18
|
-
config.
|
29
|
+
# Specifies the header that your server uses for sending files.
|
30
|
+
# config.action_dispatch.x_sendfile_header = "X-Sendfile" # for Apache
|
31
|
+
# config.action_dispatch.x_sendfile_header = "X-Accel-Redirect" # for NGINX
|
19
32
|
|
20
|
-
#
|
21
|
-
config.
|
33
|
+
# Store uploaded files on the local file system (see config/storage.yml for options).
|
34
|
+
config.active_storage.service = :local
|
22
35
|
|
23
|
-
#
|
24
|
-
# config.
|
36
|
+
# Mount Action Cable outside main process or domain.
|
37
|
+
# config.action_cable.mount_path = nil
|
38
|
+
# config.action_cable.url = "wss://example.com/cable"
|
39
|
+
# config.action_cable.allowed_request_origins = [ "http://example.com", /http:\/\/example.*/ ]
|
25
40
|
|
26
|
-
#
|
27
|
-
# config.
|
28
|
-
# config.
|
41
|
+
# Assume all access to the app is happening through a SSL-terminating reverse proxy.
|
42
|
+
# Can be used together with config.force_ssl for Strict-Transport-Security and secure cookies.
|
43
|
+
# config.assume_ssl = true
|
29
44
|
|
30
45
|
# Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies.
|
31
|
-
|
46
|
+
config.force_ssl = true
|
32
47
|
|
33
|
-
#
|
34
|
-
|
48
|
+
# Log to STDOUT by default
|
49
|
+
config.logger = ActiveSupport::Logger.new(STDOUT)
|
50
|
+
.tap { |logger| logger.formatter = ::Logger::Formatter.new }
|
51
|
+
.then { |logger| ActiveSupport::TaggedLogging.new(logger) }
|
35
52
|
|
36
|
-
# Prepend all log lines with the following tags
|
37
|
-
|
53
|
+
# Prepend all log lines with the following tags.
|
54
|
+
config.log_tags = [ :request_id ]
|
38
55
|
|
39
|
-
#
|
40
|
-
#
|
56
|
+
# "info" includes generic and useful information about system operation, but avoids logging too much
|
57
|
+
# information to avoid inadvertent exposure of personally identifiable information (PII). If you
|
58
|
+
# want to log everything, set the level to "debug".
|
59
|
+
config.log_level = ENV.fetch("RAILS_LOG_LEVEL", "info")
|
41
60
|
|
42
|
-
# Use a different cache store in production
|
61
|
+
# Use a different cache store in production.
|
43
62
|
# config.cache_store = :mem_cache_store
|
44
63
|
|
45
|
-
#
|
46
|
-
# config.
|
64
|
+
# Use a real queuing backend for Active Job (and separate queues per environment).
|
65
|
+
# config.active_job.queue_adapter = :resque
|
66
|
+
# config.active_job.queue_name_prefix = "dummy_production"
|
47
67
|
|
48
|
-
|
49
|
-
# config.assets.precompile += %w( search.js )
|
68
|
+
config.action_mailer.perform_caching = false
|
50
69
|
|
51
|
-
#
|
70
|
+
# Ignore bad email addresses and do not raise email delivery errors.
|
71
|
+
# Set this to true and configure the email server for immediate delivery to raise delivery errors.
|
52
72
|
# config.action_mailer.raise_delivery_errors = false
|
53
73
|
|
54
|
-
# Enable threaded mode
|
55
|
-
# config.threadsafe!
|
56
|
-
|
57
74
|
# Enable locale fallbacks for I18n (makes lookups for any locale fall back to
|
58
|
-
# the I18n.default_locale when a translation
|
75
|
+
# the I18n.default_locale when a translation cannot be found).
|
59
76
|
config.i18n.fallbacks = true
|
60
77
|
|
61
|
-
#
|
62
|
-
config.active_support.
|
78
|
+
# Don't log any deprecations.
|
79
|
+
config.active_support.report_deprecations = false
|
80
|
+
|
81
|
+
# Do not dump schema after migrations.
|
82
|
+
config.active_record.dump_schema_after_migration = false
|
63
83
|
|
64
|
-
#
|
65
|
-
#
|
66
|
-
#
|
84
|
+
# Enable DNS rebinding protection and other `Host` header attacks.
|
85
|
+
# config.hosts = [
|
86
|
+
# "example.com", # Allow requests from example.com
|
87
|
+
# /.*\.example\.com/ # Allow requests from subdomains like `www.example.com`
|
88
|
+
# ]
|
89
|
+
# Skip DNS rebinding protection for the default health check endpoint.
|
90
|
+
# config.host_authorization = { exclude: ->(request) { request.path == "/up" } }
|
67
91
|
end
|
@@ -1,37 +1,64 @@
|
|
1
|
-
|
2
|
-
# Settings specified here will take precedence over those in config/application.rb
|
1
|
+
require "active_support/core_ext/integer/time"
|
3
2
|
|
4
|
-
|
5
|
-
|
6
|
-
|
7
|
-
|
8
|
-
config.cache_classes = true
|
3
|
+
# The test environment is used exclusively to run your application's
|
4
|
+
# test suite. You never need to work with it otherwise. Remember that
|
5
|
+
# your test database is "scratch space" for the test suite and is wiped
|
6
|
+
# and recreated between test runs. Don't rely on the data there!
|
9
7
|
|
10
|
-
|
11
|
-
config.
|
12
|
-
config.static_cache_control = "public, max-age=3600"
|
8
|
+
Rails.application.configure do
|
9
|
+
# Settings specified here will take precedence over those in config/application.rb.
|
13
10
|
|
14
|
-
#
|
15
|
-
config.
|
11
|
+
# While tests run files are not watched, reloading is not necessary.
|
12
|
+
config.enable_reloading = false
|
16
13
|
|
17
|
-
#
|
18
|
-
|
14
|
+
# Eager loading loads your entire application. When running a single test locally,
|
15
|
+
# this is usually not necessary, and can slow down your test suite. However, it's
|
16
|
+
# recommended that you enable it in continuous integration systems to ensure eager
|
17
|
+
# loading is working properly before deploying your code.
|
18
|
+
config.eager_load = ENV["CI"].present?
|
19
|
+
|
20
|
+
# Configure public file server for tests with Cache-Control for performance.
|
21
|
+
config.public_file_server.enabled = true
|
22
|
+
config.public_file_server.headers = {
|
23
|
+
"Cache-Control" => "public, max-age=#{1.hour.to_i}"
|
24
|
+
}
|
25
|
+
|
26
|
+
# Show full error reports and disable caching.
|
27
|
+
config.consider_all_requests_local = true
|
19
28
|
config.action_controller.perform_caching = false
|
29
|
+
config.cache_store = :null_store
|
30
|
+
|
31
|
+
# Render exception templates for rescuable exceptions and raise for other exceptions.
|
32
|
+
config.action_dispatch.show_exceptions = :rescuable
|
20
33
|
|
21
|
-
#
|
22
|
-
config.
|
34
|
+
# Disable request forgery protection in test environment.
|
35
|
+
config.action_controller.allow_forgery_protection = false
|
23
36
|
|
24
|
-
#
|
25
|
-
config.
|
37
|
+
# Store uploaded files on the local file system in a temporary directory.
|
38
|
+
config.active_storage.service = :test
|
39
|
+
|
40
|
+
config.action_mailer.perform_caching = false
|
26
41
|
|
27
42
|
# Tell Action Mailer not to deliver emails to the real world.
|
28
43
|
# The :test delivery method accumulates sent emails in the
|
29
44
|
# ActionMailer::Base.deliveries array.
|
30
45
|
config.action_mailer.delivery_method = :test
|
31
46
|
|
32
|
-
#
|
33
|
-
config.active_record.mass_assignment_sanitizer = :strict
|
34
|
-
|
35
|
-
# Print deprecation notices to the stderr
|
47
|
+
# Print deprecation notices to the stderr.
|
36
48
|
config.active_support.deprecation = :stderr
|
49
|
+
|
50
|
+
# Raise exceptions for disallowed deprecations.
|
51
|
+
config.active_support.disallowed_deprecation = :raise
|
52
|
+
|
53
|
+
# Tell Active Support which deprecation messages to disallow.
|
54
|
+
config.active_support.disallowed_deprecation_warnings = []
|
55
|
+
|
56
|
+
# Raises error for missing translations.
|
57
|
+
# config.i18n.raise_on_missing_translations = true
|
58
|
+
|
59
|
+
# Annotate rendered view with file names.
|
60
|
+
# config.action_view.annotate_rendered_view_with_filenames = true
|
61
|
+
|
62
|
+
# Raise error when a before_action's only/except options reference missing actions
|
63
|
+
config.action_controller.raise_on_missing_callback_actions = true
|
37
64
|
end
|
@@ -0,0 +1,25 @@
|
|
1
|
+
# Be sure to restart your server when you modify this file.
|
2
|
+
|
3
|
+
# Define an application-wide content security policy.
|
4
|
+
# See the Securing Rails Applications Guide for more information:
|
5
|
+
# https://guides.rubyonrails.org/security.html#content-security-policy-header
|
6
|
+
|
7
|
+
# Rails.application.configure do
|
8
|
+
# config.content_security_policy do |policy|
|
9
|
+
# policy.default_src :self, :https
|
10
|
+
# policy.font_src :self, :https, :data
|
11
|
+
# policy.img_src :self, :https, :data
|
12
|
+
# policy.object_src :none
|
13
|
+
# policy.script_src :self, :https
|
14
|
+
# policy.style_src :self, :https
|
15
|
+
# # Specify URI for violation reports
|
16
|
+
# # policy.report_uri "/csp-violation-report-endpoint"
|
17
|
+
# end
|
18
|
+
#
|
19
|
+
# # Generate session nonces for permitted importmap, inline scripts, and inline styles.
|
20
|
+
# config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }
|
21
|
+
# config.content_security_policy_nonce_directives = %w(script-src style-src)
|
22
|
+
#
|
23
|
+
# # Report violations without enforcing the policy.
|
24
|
+
# # config.content_security_policy_report_only = true
|
25
|
+
# end
|
@@ -0,0 +1,8 @@
|
|
1
|
+
# Be sure to restart your server when you modify this file.
|
2
|
+
|
3
|
+
# Configure parameters to be partially matched (e.g. passw matches password) and filtered from the log file.
|
4
|
+
# Use this to limit dissemination of sensitive information.
|
5
|
+
# See the ActiveSupport::ParameterFilter documentation for supported notations and behaviors.
|
6
|
+
Rails.application.config.filter_parameters += [
|
7
|
+
:passw, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn
|
8
|
+
]
|
@@ -1,15 +1,16 @@
|
|
1
1
|
# Be sure to restart your server when you modify this file.
|
2
2
|
|
3
|
-
# Add new inflection rules using the following format
|
4
|
-
#
|
5
|
-
#
|
6
|
-
#
|
7
|
-
# inflect.
|
8
|
-
# inflect.
|
3
|
+
# Add new inflection rules using the following format. Inflections
|
4
|
+
# are locale specific, and you may define rules for as many different
|
5
|
+
# locales as you wish. All of these examples are active by default:
|
6
|
+
# ActiveSupport::Inflector.inflections(:en) do |inflect|
|
7
|
+
# inflect.plural /^(ox)$/i, "\\1en"
|
8
|
+
# inflect.singular /^(ox)en/i, "\\1"
|
9
|
+
# inflect.irregular "person", "people"
|
9
10
|
# inflect.uncountable %w( fish sheep )
|
10
11
|
# end
|
11
|
-
|
12
|
+
|
12
13
|
# These inflection rules are supported but not enabled by default:
|
13
|
-
# ActiveSupport::Inflector.inflections do |inflect|
|
14
|
-
# inflect.acronym
|
14
|
+
# ActiveSupport::Inflector.inflections(:en) do |inflect|
|
15
|
+
# inflect.acronym "RESTful"
|
15
16
|
# end
|
@@ -0,0 +1,13 @@
|
|
1
|
+
# Be sure to restart your server when you modify this file.
|
2
|
+
|
3
|
+
# Define an application-wide HTTP permissions policy. For further
|
4
|
+
# information see: https://developers.google.com/web/updates/2018/06/feature-policy
|
5
|
+
|
6
|
+
# Rails.application.config.permissions_policy do |policy|
|
7
|
+
# policy.camera :none
|
8
|
+
# policy.gyroscope :none
|
9
|
+
# policy.microphone :none
|
10
|
+
# policy.usb :none
|
11
|
+
# policy.fullscreen :self
|
12
|
+
# policy.payment :self, "https://secure.example.com"
|
13
|
+
# end
|
@@ -0,0 +1,34 @@
|
|
1
|
+
test:
|
2
|
+
service: Disk
|
3
|
+
root: <%= Rails.root.join("tmp/storage") %>
|
4
|
+
|
5
|
+
local:
|
6
|
+
service: Disk
|
7
|
+
root: <%= Rails.root.join("storage") %>
|
8
|
+
|
9
|
+
# Use bin/rails credentials:edit to set the AWS secrets (as aws:access_key_id|secret_access_key)
|
10
|
+
# amazon:
|
11
|
+
# service: S3
|
12
|
+
# access_key_id: <%= Rails.application.credentials.dig(:aws, :access_key_id) %>
|
13
|
+
# secret_access_key: <%= Rails.application.credentials.dig(:aws, :secret_access_key) %>
|
14
|
+
# region: us-east-1
|
15
|
+
# bucket: your_own_bucket-<%= Rails.env %>
|
16
|
+
|
17
|
+
# Remember not to checkin your GCS keyfile to a repository
|
18
|
+
# google:
|
19
|
+
# service: GCS
|
20
|
+
# project: your_project
|
21
|
+
# credentials: <%= Rails.root.join("path/to/gcs.keyfile") %>
|
22
|
+
# bucket: your_own_bucket-<%= Rails.env %>
|
23
|
+
|
24
|
+
# Use bin/rails credentials:edit to set the Azure Storage secret (as azure_storage:storage_access_key)
|
25
|
+
# microsoft:
|
26
|
+
# service: AzureStorage
|
27
|
+
# storage_account_name: your_account_name
|
28
|
+
# storage_access_key: <%= Rails.application.credentials.dig(:azure_storage, :storage_access_key) %>
|
29
|
+
# container: your_container_name-<%= Rails.env %>
|
30
|
+
|
31
|
+
# mirror:
|
32
|
+
# service: Mirror
|
33
|
+
# primary: local
|
34
|
+
# mirrors: [ amazon, google, microsoft ]
|
Binary file
|
File without changes
|
@@ -0,0 +1,32 @@
|
|
1
|
+
[1m[35m (0.2ms)[0m [1m[35mCREATE TABLE "schema_migrations" ("version" varchar NOT NULL PRIMARY KEY)[0m
|
2
|
+
[1m[35m (0.1ms)[0m [1m[35mCREATE TABLE "ar_internal_metadata" ("key" varchar NOT NULL PRIMARY KEY, "value" varchar, "created_at" datetime(6) NOT NULL, "updated_at" datetime(6) NOT NULL)[0m
|
3
|
+
[1m[36mActiveRecord::SchemaMigration Load (0.0ms)[0m [1m[34mSELECT "schema_migrations"."version" FROM "schema_migrations" ORDER BY "schema_migrations"."version" ASC[0m
|
4
|
+
[1m[36mTRANSACTION (0.0ms)[0m [1m[36mbegin transaction[0m
|
5
|
+
-------------------------------
|
6
|
+
LimitedSessionsTest: test_truth
|
7
|
+
-------------------------------
|
8
|
+
[1m[36mTRANSACTION (0.0ms)[0m [1m[31mrollback transaction[0m
|
9
|
+
[1m[36mActiveRecord::SchemaMigration Load (0.1ms)[0m [1m[34mSELECT "schema_migrations"."version" FROM "schema_migrations" ORDER BY "schema_migrations"."version" ASC[0m
|
10
|
+
[1m[36mTRANSACTION (0.0ms)[0m [1m[36mbegin transaction[0m
|
11
|
+
-------------------------------
|
12
|
+
LimitedSessionsTest: test_truth
|
13
|
+
-------------------------------
|
14
|
+
[1m[36mTRANSACTION (0.0ms)[0m [1m[31mrollback transaction[0m
|
15
|
+
[1m[36mActiveRecord::SchemaMigration Load (0.1ms)[0m [1m[34mSELECT "schema_migrations"."version" FROM "schema_migrations" ORDER BY "schema_migrations"."version" ASC[0m
|
16
|
+
[1m[36mTRANSACTION (0.0ms)[0m [1m[36mbegin transaction[0m
|
17
|
+
-------------------------------
|
18
|
+
LimitedSessionsTest: test_truth
|
19
|
+
-------------------------------
|
20
|
+
[1m[36mTRANSACTION (0.0ms)[0m [1m[31mrollback transaction[0m
|
21
|
+
[1m[36mActiveRecord::SchemaMigration Load (0.1ms)[0m [1m[34mSELECT "schema_migrations"."version" FROM "schema_migrations" ORDER BY "schema_migrations"."version" ASC[0m
|
22
|
+
[1m[36mTRANSACTION (0.0ms)[0m [1m[36mbegin transaction[0m
|
23
|
+
-------------------------------
|
24
|
+
LimitedSessionsTest: test_truth
|
25
|
+
-------------------------------
|
26
|
+
[1m[36mTRANSACTION (0.0ms)[0m [1m[31mrollback transaction[0m
|
27
|
+
[1m[36mActiveRecord::SchemaMigration Load (0.8ms)[0m [1m[34mSELECT "schema_migrations"."version" FROM "schema_migrations" ORDER BY "schema_migrations"."version" ASC[0m
|
28
|
+
[1m[36mTRANSACTION (0.0ms)[0m [1m[36mbegin transaction[0m
|
29
|
+
-------------------------------
|
30
|
+
LimitedSessionsTest: test_truth
|
31
|
+
-------------------------------
|
32
|
+
[1m[36mTRANSACTION (0.0ms)[0m [1m[31mrollback transaction[0m
|
@@ -0,0 +1 @@
|
|
1
|
+
8fd67d45715697e94966a817d1a8c01cbc0be4ccc8994af27ef312492d744de6eb69cf6693a6b3a0262f5ccffcae13ded8f1c0846a1baf713d2c1dc043d73aa6
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: limited_sessions
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 5.0.
|
4
|
+
version: 5.0.3
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- t.e.morgan
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date:
|
11
|
+
date: 2024-11-06 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: rack
|
@@ -34,16 +34,16 @@ dependencies:
|
|
34
34
|
name: sqlite3
|
35
35
|
requirement: !ruby/object:Gem::Requirement
|
36
36
|
requirements:
|
37
|
-
- - "
|
37
|
+
- - "~>"
|
38
38
|
- !ruby/object:Gem::Version
|
39
|
-
version: '
|
39
|
+
version: '1.4'
|
40
40
|
type: :development
|
41
41
|
prerelease: false
|
42
42
|
version_requirements: !ruby/object:Gem::Requirement
|
43
43
|
requirements:
|
44
|
-
- - "
|
44
|
+
- - "~>"
|
45
45
|
- !ruby/object:Gem::Version
|
46
|
-
version: '
|
46
|
+
version: '1.4'
|
47
47
|
- !ruby/object:Gem::Dependency
|
48
48
|
name: rails
|
49
49
|
requirement: !ruby/object:Gem::Requirement
|
@@ -53,7 +53,7 @@ dependencies:
|
|
53
53
|
version: '5.2'
|
54
54
|
- - "<"
|
55
55
|
- !ruby/object:Gem::Version
|
56
|
-
version: '
|
56
|
+
version: '8.0'
|
57
57
|
type: :development
|
58
58
|
prerelease: false
|
59
59
|
version_requirements: !ruby/object:Gem::Requirement
|
@@ -63,7 +63,7 @@ dependencies:
|
|
63
63
|
version: '5.2'
|
64
64
|
- - "<"
|
65
65
|
- !ruby/object:Gem::Version
|
66
|
-
version: '
|
66
|
+
version: '8.0'
|
67
67
|
description: 'LimitedSessions provides two core features to handle cookie-based session
|
68
68
|
expiry: 1) Rack Middleware for most session stores and 2) an ActiveRecord extension
|
69
69
|
for AR-based session stores. Sessions can be expired on inactivity and/or overall
|
@@ -75,7 +75,7 @@ extensions: []
|
|
75
75
|
extra_rdoc_files: []
|
76
76
|
files:
|
77
77
|
- CHANGELOG
|
78
|
-
-
|
78
|
+
- LICENSE.txt
|
79
79
|
- README.md
|
80
80
|
- Rakefile
|
81
81
|
- lib/limited_sessions.rb
|
@@ -90,27 +90,39 @@ files:
|
|
90
90
|
- test/dummy/app/controllers/application_controller.rb
|
91
91
|
- test/dummy/app/helpers/application_helper.rb
|
92
92
|
- test/dummy/app/views/layouts/application.html.erb
|
93
|
+
- test/dummy/bin/rails
|
94
|
+
- test/dummy/bin/rake
|
95
|
+
- test/dummy/bin/setup
|
93
96
|
- test/dummy/config.ru
|
94
97
|
- test/dummy/config/application.rb
|
95
98
|
- test/dummy/config/boot.rb
|
99
|
+
- test/dummy/config/cable.yml
|
96
100
|
- test/dummy/config/database.yml
|
97
101
|
- test/dummy/config/environment.rb
|
98
102
|
- test/dummy/config/environments/development.rb
|
99
103
|
- test/dummy/config/environments/production.rb
|
100
104
|
- test/dummy/config/environments/test.rb
|
101
105
|
- test/dummy/config/initializers/backtrace_silencers.rb
|
106
|
+
- test/dummy/config/initializers/content_security_policy.rb
|
107
|
+
- test/dummy/config/initializers/filter_parameter_logging.rb
|
102
108
|
- test/dummy/config/initializers/inflections.rb
|
103
109
|
- test/dummy/config/initializers/mime_types.rb
|
110
|
+
- test/dummy/config/initializers/permissions_policy.rb
|
104
111
|
- test/dummy/config/initializers/secret_token.rb
|
105
112
|
- test/dummy/config/initializers/session_store.rb
|
106
113
|
- test/dummy/config/initializers/wrap_parameters.rb
|
107
114
|
- test/dummy/config/locales/en.yml
|
108
115
|
- test/dummy/config/routes.rb
|
116
|
+
- test/dummy/config/storage.yml
|
117
|
+
- test/dummy/db/test.sqlite3
|
118
|
+
- test/dummy/log/development.log
|
119
|
+
- test/dummy/log/test.log
|
109
120
|
- test/dummy/public/404.html
|
110
121
|
- test/dummy/public/422.html
|
111
122
|
- test/dummy/public/500.html
|
112
123
|
- test/dummy/public/favicon.ico
|
113
124
|
- test/dummy/script/rails
|
125
|
+
- test/dummy/tmp/local_secret.txt
|
114
126
|
- test/limited_sessions_test.rb
|
115
127
|
- test/test_helper.rb
|
116
128
|
homepage: https://iprog.com/projects#limited_sessions
|
@@ -133,7 +145,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
133
145
|
- !ruby/object:Gem::Version
|
134
146
|
version: '0'
|
135
147
|
requirements: []
|
136
|
-
rubygems_version: 3.
|
148
|
+
rubygems_version: 3.5.22
|
137
149
|
signing_key:
|
138
150
|
specification_version: 4
|
139
151
|
summary: Server-side session expiry via either Rack Middleware or ActiveRecord extension
|
@@ -145,26 +157,38 @@ test_files:
|
|
145
157
|
- test/dummy/app/controllers/application_controller.rb
|
146
158
|
- test/dummy/app/helpers/application_helper.rb
|
147
159
|
- test/dummy/app/views/layouts/application.html.erb
|
160
|
+
- test/dummy/bin/rails
|
161
|
+
- test/dummy/bin/rake
|
162
|
+
- test/dummy/bin/setup
|
148
163
|
- test/dummy/config/application.rb
|
149
164
|
- test/dummy/config/boot.rb
|
165
|
+
- test/dummy/config/cable.yml
|
150
166
|
- test/dummy/config/database.yml
|
151
167
|
- test/dummy/config/environment.rb
|
152
168
|
- test/dummy/config/environments/development.rb
|
153
169
|
- test/dummy/config/environments/production.rb
|
154
170
|
- test/dummy/config/environments/test.rb
|
155
171
|
- test/dummy/config/initializers/backtrace_silencers.rb
|
172
|
+
- test/dummy/config/initializers/content_security_policy.rb
|
173
|
+
- test/dummy/config/initializers/filter_parameter_logging.rb
|
156
174
|
- test/dummy/config/initializers/inflections.rb
|
157
175
|
- test/dummy/config/initializers/mime_types.rb
|
176
|
+
- test/dummy/config/initializers/permissions_policy.rb
|
158
177
|
- test/dummy/config/initializers/secret_token.rb
|
159
178
|
- test/dummy/config/initializers/session_store.rb
|
160
179
|
- test/dummy/config/initializers/wrap_parameters.rb
|
161
180
|
- test/dummy/config/locales/en.yml
|
162
181
|
- test/dummy/config/routes.rb
|
182
|
+
- test/dummy/config/storage.yml
|
163
183
|
- test/dummy/config.ru
|
184
|
+
- test/dummy/db/test.sqlite3
|
185
|
+
- test/dummy/log/development.log
|
186
|
+
- test/dummy/log/test.log
|
164
187
|
- test/dummy/public/404.html
|
165
188
|
- test/dummy/public/422.html
|
166
189
|
- test/dummy/public/500.html
|
167
190
|
- test/dummy/public/favicon.ico
|
168
191
|
- test/dummy/script/rails
|
192
|
+
- test/dummy/tmp/local_secret.txt
|
169
193
|
- test/limited_sessions_test.rb
|
170
194
|
- test/test_helper.rb
|