macaw_framework 1.2.5 → 1.2.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fd7f1b0bfc6306d0d86f2228f3a51cf955cad0db12031920cf9f0f131d664f6d
-  data.tar.gz: 92ea7a2854218fb31726c37bc6cbe99399159cdb0cc08a3c72ce62e4b27e72c2
+  metadata.gz: 2353cd5ffe4a264a2eacab71fc2de65c5c4a6b2cd925666529e36b8bdde0ada6
+  data.tar.gz: 4855cf3e106380f6c6718058001cd6cbd888a6c0f1927f833da3bc97cf648785
 SHA512:
-  metadata.gz: 1a06342e79d24109aa1b47058e7a973009e9e19a0a898f95c653a13dd3558b5576be34b628f5fbf488aa0b019f35ed6f941fd1b3808c7894bac9dd1b9d9c85e5
-  data.tar.gz: cfff2868edfd0314006a36cdeb21d1f69ed6388b2c9a5181cec7f67c1c101818f6feb58e865d3672c84b55c3d71372a3850e9dd6b0ee6f3f948baec5af2a726c
+  metadata.gz: 85f5262044b8b3029ad507d501655f72ccd022630b34fc72a5606fe993d223a7e83b245b2ee858adbedf1723717d2d050e1276badf2a353d89612d2c544253a4
+  data.tar.gz: 31b67715e3f2b2c792262d53f6488ae0b8df38c2c1f700fd5590b45927f49dc47fa8c84db884d2ec560b0e981582091b3f38a0f8af06bbddb26efd26f33e2e58

data/CHANGELOG.md

@@ -132,3 +132,7 @@
 ## [1.2.5]
 
 - Improvements to cache usability
+
+## [1.2.6]
+
+- Improving session strategy and fixing vulnerabilities on it.

data/README.md

@@ -113,6 +113,15 @@ end
 
 ### Session management: Handle user sessions with server-side in-memory storage
 
+Session will only be enabled if it's configurations exists in the `application.json` file.
+The session mechanism works by recovering the Session ID from a client sent header. The default
+header is `X-Session-ID`, but it can be changed in the `application.json` file.
+
+This header will be sent back to the user on every response if Session is enabled. Also, the
+session ID will be automatically generated and sent to a client if this client does not provide
+a session id in the HTTP request. In the case of the client sending an ID of an expired session
+the framework will return a new session with a new ID.
+
 ```ruby
 m.get('/login') do |context|
   # Authenticate user
@@ -129,8 +138,6 @@ m.get('/dashboard') do |context|
 end
 ```
 
-**Caution: This feature is vulnerable to IP spoofing and may disrupt sessions on devices sharing the same network (e.g., Wi-Fi).**
-
 ### Configuration: Customize various aspects of the framework through the application.json configuration file, such as rate limiting, SSL support, and Prometheus integration
 
 ```json
@@ -155,6 +162,10 @@ end
       "key_type": "EC",
       "cert_file_name": "path/to/cert/file/file.crt",
       "key_file_name": "path/to/cert/key/file.key"
+    },
+    "session": {
+      "secure_header": "X-Session-ID",
+      "invalidation_time": 3600
     }
   }
 }

data/lib/macaw_framework/core/common/server_base.rb

@@ -8,6 +8,7 @@ require_relative "../../utils/supported_ssl_versions"
 require_relative "../../aspects/prometheus_aspect"
 require_relative "../../aspects/logging_aspect"
 require_relative "../../aspects/cache_aspect"
+require "securerandom"
 
 ##
 # Base module for Server classes. It contains
@@ -21,14 +22,14 @@ module ServerBase
 
   private
 
-  def call_endpoint(name, client_data, client_ip)
+  def call_endpoint(name, client_data, session_id, _client_ip)
     @macaw.send(
       name.to_sym,
       {
         headers: client_data[:headers],
         body: client_data[:body],
         params: client_data[:params],
-        client: @session[client_ip][0]
+        client: @session[session_id][0]
       }
     )
   end
@@ -42,12 +43,14 @@ module ServerBase
     raise EndpointNotMappedError unless @macaw.respond_to?(method_name)
     raise TooManyRequestsError unless @rate_limit.nil? || @rate_limit.allow?(client.peeraddr[3])
 
-    declare_client_session(client)
     client_data = get_client_data(body, headers, parameters)
+    session_id = declare_client_session(client_data[:headers], @macaw.secure_header) if @macaw.session
 
     @macaw_log&.info("Running #{path.gsub("\n", "").gsub("\r", "")}")
     message, status, response_headers = call_endpoint(@prometheus_middleware, @macaw_log, @cache,
-                                                      method_name, client_data, client.peeraddr[3])
+                                                      method_name, client_data, session_id, client.peeraddr[3])
+    response_headers ||= {}
+    response_headers[@macaw.secure_header] = session_id if @macaw.session
     status ||= 200
     message ||= nil
     response_headers ||= nil
@@ -69,9 +72,11 @@ module ServerBase
     end
   end
 
-  def declare_client_session(client)
-    @session[client.peeraddr[3]] ||= [{}, Time.now]
-    @session[client.peeraddr[3]] = [{}, Time.now] if @session[client.peeraddr[3]][0].nil?
+  def declare_client_session(headers, secure_header_name)
+    session_id = headers[secure_header_name] || SecureRandom.uuid
+    session_id = SecureRandom.uuid if @session[session_id].nil?
+    @session[session_id] ||= [{}, Time.now]
+    session_id
   end
 
   def set_rate_limiting
@@ -110,7 +115,7 @@ module ServerBase
   end
 
   def set_session
-    @session = {}
+    @session ||= {}
     inv = if @macaw.config&.dig("macaw", "session", "invalidation_time")
             MemoryInvalidationMiddleware.new(@macaw.config["macaw"]["session"]["invalidation_time"])
           else
@@ -122,7 +127,7 @@ module ServerBase
   def set_features
     @is_shutting_down = false
     set_rate_limiting
-    set_session
+    set_session if @macaw.session
     set_ssl
   end
 end

data/lib/macaw_framework/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module MacawFramework
-  VERSION = "1.2.5"
+  VERSION = "1.2.6"
 end

data/lib/macaw_framework.rb

@@ -19,7 +19,7 @@ module MacawFramework
   # Class responsible for creating endpoints and
   # starting the web server.
   class Macaw
-    attr_reader :routes, :macaw_log, :config, :jobs, :cached_methods
+    attr_reader :routes, :macaw_log, :config, :jobs, :cached_methods, :secure_header, :session
     attr_accessor :port, :bind, :threads
 
     ##
@@ -28,23 +28,7 @@ module MacawFramework
     # @param {ThreadServer} server
     # @param {String?} dir
     def initialize(custom_log: Logger.new($stdout), server: ThreadServer, dir: nil)
-      begin
-        @routes = []
-        @cached_methods = {}
-        @macaw_log ||= custom_log
-        @config = JSON.parse(File.read("application.json"))
-        @port = @config["macaw"]["port"] || 8080
-        @bind = @config["macaw"]["bind"] || "localhost"
-        @threads = @config["macaw"]["threads"] || 200
-        unless @config["macaw"]["cache"].nil?
-          @cache = MemoryInvalidationMiddleware.new(@config["macaw"]["cache"]["cache_invalidation"].to_i || 3_600)
-        end
-        @prometheus = Prometheus::Client::Registry.new if @config["macaw"]["prometheus"]
-        @prometheus_middleware = PrometheusMiddleware.new if @config["macaw"]["prometheus"]
-        @prometheus_middleware.configure_prometheus(@prometheus, @config, self) if @config["macaw"]["prometheus"]
-      rescue StandardError => e
-        @macaw_log&.warn(e.message)
-      end
+      apply_options(custom_log)
       create_endpoint_public_files(dir)
       @port ||= 8080
       @bind ||= "localhost"
@@ -193,6 +177,29 @@ module MacawFramework
 
     private
 
+    def apply_options(custom_log)
+      @routes = []
+      @cached_methods = {}
+      @macaw_log ||= custom_log
+      @config = JSON.parse(File.read("application.json"))
+      @port = @config["macaw"]["port"] || 8080
+      @bind = @config["macaw"]["bind"] || "localhost"
+      @session = false
+      unless @config["macaw"]["session"].nil?
+        @session = true
+        @secure_header = @config["macaw"]["session"]["secure_header"] || "X-Session-ID"
+      end
+      @threads = @config["macaw"]["threads"] || 200
+      unless @config["macaw"]["cache"].nil?
+        @cache = MemoryInvalidationMiddleware.new(@config["macaw"]["cache"]["cache_invalidation"].to_i || 3_600)
+      end
+      @prometheus = Prometheus::Client::Registry.new if @config["macaw"]["prometheus"]
+      @prometheus_middleware = PrometheusMiddleware.new if @config["macaw"]["prometheus"]
+      @prometheus_middleware.configure_prometheus(@prometheus, @config, self) if @config["macaw"]["prometheus"]
+    rescue StandardError => e
+      @macaw_log&.warn(e.message)
+    end
+
     def server_loop(server)
       server.run
     end

data/sig/macaw_framework/macaw.rbs

@@ -10,8 +10,11 @@ module MacawFramework
 
     @prometheus: untyped
     @prometheus_middleware: untyped
+    @secure_header: String
     @server: untyped
 
+    @server_class: untyped
+    @session: bool
     @threads: Integer
 
     attr_accessor bind: String

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: macaw_framework
 version: !ruby/object:Gem::Version
-  version: 1.2.5
+  version: 1.2.6
 platform: ruby
 authors:
 - Aria Diniz
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-04-14 00:00:00.000000000 Z
+date: 2024-04-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: prometheus-client