magic_links 1.0.1 → 1.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b6939cd65d873662c0c1101a1073e1d9dcfef386af25be14aa8d8232a5b293e7
-  data.tar.gz: 437b07e49b311be7721c3e3882275893ce3fe1ce2587105665b0a9e827c8f655
+  metadata.gz: 48af8c70fa309dcb3b6e3159d0f571a49635a8bd85288956faa0e5e10e14a341
+  data.tar.gz: 03d55c9dbd0d9aca3f03eb67099024387dc9d9e17b497fcc5731c1c1a3c4d0a8
 SHA512:
-  metadata.gz: 0146bba9e94182eb77b5bc001abfb0edcd232ea07fea288868fbdb63c4279676084147abe4da32b91257f91ff0b263b086095d068efdcf72399c934e37525bd5
-  data.tar.gz: 8b5d6a7bfec01316fa1f232d4239838b95a737f2d062c22af3a7ecc5be1b294be90794ee78d3f81ba02cb0631a9afb8f0d57e2e26d38e99de75a8157db455cf8
+  metadata.gz: 9dc60a5fe9b2432087b78b24dd5ab09bb4fa436956a852e4a1ce354b48850f3bba453cac4fa1d711b9949a2ac383e80e0f9717c151723b2a96b72c356e49c814
+  data.tar.gz: 99dcdfd7d10686e84c23b7d76b3e31ba53b86d7f9c2708d08fa3f2ab7341310b4beaedbd76676c3c058467e07ba8f680b83b1309c71135f5b5d4a3874d7ed184

data/README.md

@@ -94,5 +94,18 @@ end
 When using the `magic_url_for` helper you'll need to specify default_url_options for your development and testing
 environments.
 
+### Magic token cookie expiry
+A magic token cookie is dropped on the client when a magic link is used. This cookie is used to authenticate subsequent 
+requests. By default, the magic token cookie expiry (not to be confused with the expiry of the magic link) is set to 
+1 hour. You can override this setting by setting it in an initializer:
+
+```ruby
+# in /config/initializers/magic_links.rb
+
+MagicLinks.magic_token_cookie_expiry = 15.minutes
+```
+
+By setting a short expiry it reduces security risks on shared devices.
+
 ## License
 The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).

data/lib/magic_links/middleware/magic_token_redirect.rb

@@ -22,7 +22,7 @@ module MagicLinks
           return unless redirect_request?
           return root unless magic_token.present?
 
-          cookies.signed[magic_token_key] = magic_token.token if scope
+          cookies.encrypted[magic_token_key] = {value: magic_token.token, expires: cookie_expiry} if scope
           respond_with_redirect magic_token.target_path
         end
 
@@ -72,6 +72,10 @@ module MagicLinks
         def cookies
           request.cookie_jar
         end
+
+        def cookie_expiry
+          MagicLinks.magic_token_cookie_expiry
+        end
       end
     end
   end

data/lib/magic_links/strategies/magic_token_authentication.rb

@@ -55,7 +55,7 @@ module MagicLinks
       end
 
       def magic_token_cookie
-        @magic_token_cookie ||= cookies.signed[magic_token_key]
+        @magic_token_cookie ||= cookies.encrypted[magic_token_key]
       end
 
       def controller

data/lib/magic_links/version.rb

@@ -1,5 +1,5 @@
 module MagicLinks
-  VERSION = '1.0.1'
+  VERSION = '1.1.1'
 
   def self.version
     VERSION

data/lib/magic_links.rb

@@ -6,6 +6,8 @@ require 'magic_links/strategies/magic_token_authentication'
 require 'magic_links/rails'
 
 module MagicLinks
+  mattr_accessor :magic_token_cookie_expiry, default: 1.hour
+
   def self.add_template(*args)
     MagicLinks::Templates.add(*args)
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: magic_links
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.1.1
 platform: ruby
 authors:
 - James wozniak
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-06-24 00:00:00.000000000 Z
+date: 2022-07-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -124,7 +124,7 @@ licenses:
 metadata:
   allowed_push_host: https://rubygems.org
   source_code_uri: https://github.com/ClickMechanic/magic_links
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -140,7 +140,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubygems_version: 3.1.6
-signing_key:
+signing_key: 
 specification_version: 4
 summary: Token based authentication
 test_files: []