masks 0.12.0 → 0.12.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 22811283549c975e2550ab8546760831275db1efa68ddfd16ebe1dcfb96278a5
-  data.tar.gz: 888decf6ea332f751cb446a4e7535313527141ed64086cbf62acc2787d320a9b
+  metadata.gz: 421d8bafc01e79df7edd7738c30d85a09919fe62dae16944a0d53278fd93f616
+  data.tar.gz: 9671445e035576d9c89b3d4cdffa28b7a6448b29c23201ad791085c3d30cfa2e
 SHA512:
-  metadata.gz: 33275896c9010d94818885f7a0a3f71b83f6782af7384cf29fb70d482b03492b8e662f27d6f748e1d9a05f453f5294dc910ca5d1492395c7bc3e0bc57aaaea6f
-  data.tar.gz: 5fb2c1d80a01a0723c3533bc8861cca4c2d0761e9ef5d4ef21f46de41d611835bf9fefe28ac0bab860b65bb0ee166cf8288fbda1a178644f58dc3a850edaea96
+  metadata.gz: 521d775b39d102648c40f513ccb0d23299ee0af608d882a3eba878d2c8d4d0bd1713fd2a245d74bf725416c62b6e85e9fc596ce11343e29708068d4d31ff1817
+  data.tar.gz: 535c2e15b8ea0c574a8fca4109e2e6133c0f52991d4764be81ef3a20421142fafe8bb58a6e9d49e3ecc672c168b680e90b7cc73b4412233cab183fffacf65089

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [0.12.1](https://github.com/masksrb/masks/compare/gem/v0.12.0...gem/v0.12.1) (2026-10-19)
+
+
+### Fixes
+
+* **client:** a Rails sign-out link followed by a browser that names no site asks before signing out ([c62c6c1](https://github.com/masksrb/masks/commit/c62c6c1854bb2f7a60339468f6db1b408d6786b9))
+* **client:** one Rails guard decides where a sign-out came from, so a POST that names no site is refused and the Sign out page carries everywhere in its address ([ed86c45](https://github.com/masksrb/masks/commit/ed86c45692dc4d8a0614697ccc832fe1358bd58d))
+
 ## [0.12.0](https://github.com/masksrb/masks/compare/gem/v0.11.0...gem/v0.12.0) (2026-10-14)
 
 

data/app/controllers/masks/rails/sessions_controller.rb

@@ -4,8 +4,14 @@ module Masks
       RESTARTED = "masks_restarted_at".freeze
       RESTART_WITHIN = 60
       SAME_ORIGIN = %w[same-origin none].freeze
+      CONFIRMATION_HEADERS = {
+        "Cache-Control" => "no-store",
+        "X-Content-Type-Options" => "nosniff",
+        "X-Frame-Options" => "DENY",
+        "Content-Security-Policy" => "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'"
+      }.freeze
 
-      before_action :refuse_cross_site, only: :destroy
+      before_action :require_this_site, only: :destroy
 
       def show
         if masks_configured? && (masks_signed_in? || (masks_tokens && masks_refresh!))
@@ -99,20 +105,29 @@ module Masks
 
       private
 
-        def refuse_cross_site
-          return if same_origin?
+        def require_this_site
+          from = provenance
+          return if from == :this_site
 
-          answer("invalid_request", "that request came from another site", :forbidden, failed: "sign-out")
-        end
+          if from == :elsewhere || request.post? || request.delete?
+            return answer("invalid_request", "that request came from another site", :forbidden, failed: "sign-out")
+          end
 
-        def same_origin?
-          site = request.headers["Sec-Fetch-Site"].to_s
+          return answer("invalid_request", "sign out with a POST from this site", :forbidden) if masks_wants_json?
 
-          return false unless site.empty? || SAME_ORIGIN.include?(site)
+          @action = logout_path(request.query_parameters.slice("everywhere"))
+          response.headers.merge!(CONFIRMATION_HEADERS)
+          render :confirm, formats: :html
+        end
 
+        def provenance
+          site = request.headers["Sec-Fetch-Site"].to_s
           sent = request.headers["Origin"].to_s
 
-          sent.empty? || [ request.base_url, own_origin ].include?(sent)
+          return :elsewhere unless site.empty? || SAME_ORIGIN.include?(site)
+          return :elsewhere unless sent.empty? || [ request.base_url, own_origin ].include?(sent)
+
+          site.empty? && sent.empty? ? :unproven : :this_site
         end
 
         def own_origin

data/app/views/masks/rails/sessions/confirm.html.erb

@@ -0,0 +1,9 @@
+<% content_for :title, "Sign out" %>
+
+<h1>Sign out</h1>
+
+<p>Select Sign out to finish signing out.</p>
+
+<%= form_with url: @action, method: :post do %>
+  <button type="submit">Sign out</button>
+<% end %>

data/lib/masks/version.rb

@@ -1,3 +1,3 @@
 module Masks
-  VERSION = "0.12.0".freeze
+  VERSION = "0.12.1".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: masks
 version: !ruby/object:Gem::Version
-  version: 0.12.0
+  version: 0.12.1
 platform: ruby
 authors:
 - the masks authors
@@ -42,6 +42,7 @@ files:
 - app/views/layouts/masks/rails/plain.html.erb
 - app/views/masks/rails/handshakes/refused.html.erb
 - app/views/masks/rails/handshakes/show.html.erb
+- app/views/masks/rails/sessions/confirm.html.erb
 - config/routes.rb
 - lib/generators/masks/install/install_generator.rb
 - lib/generators/masks/install/templates/masks.rb.tt