multi_session 1.1.0 → 1.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e401b25f019731faaad3230a51406a7853c071837f9a134c7779bf2f1130841f
-  data.tar.gz: ef26f4a723075fcdb0b19406a787a8bd6fabd84e8fb4fac417c96a1be3c3d281
+  metadata.gz: c210534cd8cb3dd7e72a786288a235fddd5d6a06ea45c8a62813dddb2aa61154
+  data.tar.gz: f9f3ecb1923aaec68643a2c29cebaa42488d20b5d5c1c7590f73a775d235d20f
 SHA512:
-  metadata.gz: 19f01b7549b920e6d25e6a072fabd846c80d6cd8f4ed60bb48ce75e88a58363abfc72ee9a8d42ba40aa62b02f01572294b67aac68f0eccb0711121d4711d9ad6
-  data.tar.gz: b2f5cd824bbc7e84310f352c08ce36ecb8450711ec5605846dbccc31e4b5c450d4bac6df72873afbc367d3284c7f0282f9004c9a3fb3b008d3d0d280b40f0c21
+  metadata.gz: b133c108f883baa7a486758a24b2b338fd3def90f6fa8766f8f941fcfd9e8cbb21b37f70c420578d2dd4260f67e16a1176e917060245abd297af852f28d56863
+  data.tar.gz: 98c4f3c4d680c27393cf1c9ce99df8710c8355e4eeebcbcf27f52d91034eaa491dd01544652aac31341ef79e50a01af7fdd902cf98f3b568eb432eef8df746f2

data/README.md

@@ -53,7 +53,7 @@ multi_session_keys: # use `rake secret` to generate custom keys
   user_preferences: # insert a different secret here
 ```
 
-## Installation
+## Installation and Requirements
 
 Add this line to your application's Gemfile:
 
@@ -61,6 +61,8 @@ Add this line to your application's Gemfile:
 gem 'multi_session', '~> 1.1'
 ```
 
+Currently `multi_session` will only work with Rails version 5.2.0 or higher. In version 5.2, Rails switched the default session encryption from `aes-256-cbc` to `aes-256-gcm`. This gem has only been coded to work with the `aes-256-gcm` cipher which unfortunately does not work with older versions of `ActiveSupport::MessageEncryptor`.
+
 ## Configuration
 
 For the current version `multi_session`, there these are the configuration values that can optionally be set:

data/lib/multi_session/session.rb

@@ -4,13 +4,13 @@ module MultiSession
       @cookies = cookies
     end
 
-    def [](key)
+    def [] key
       return nil unless @cookies[key.to_s].present?
-      session = ActiveSupport::JSON.decode encryptor(key).decrypt_and_verify(@cookies[key])
+      session = ActiveSupport::JSON.decode encryptor(key.to_s).decrypt_and_verify(@cookies[key.to_s])
       session['value'] # TODO: add ability to let developer retrieve the session_id
     end
 
-    def []=(key, value)
+    def []= key, value
       previous_session = self[key]
       session_id = if previous_session && previous_session['session_id'].present?
         previous_session['session_id']
@@ -18,12 +18,14 @@ module MultiSession
         SecureRandom.hex(16).encode Encoding::UTF_8
       end
 
-      new_session = {
-        'session_id' => session_id,
-        'value' => value
-      }
-      expiry_options = MultiSession.expires.present? ? {expires_at: Time.now + MultiSession.expires} : {}
-      encrypted_and_signed_value = encryptor(key).encrypt_and_sign ActiveSupport::JSON.encode(new_session), expiry_options
+      new_session = {'session_id' => session_id, 'value' => value}
+      enc = encryptor key.to_s
+      if enc.method(:encrypt_and_sign).arity > 1 # check number of arguments for encrypt_and_sign (more than 1 means we're in Rails 5.2+ and can have expirable messages)
+        expiry_options = MultiSession.expires.present? ? {expires_at: Time.now + MultiSession.expires} : {}
+        encrypted_and_signed_value = enc.encrypt_and_sign ActiveSupport::JSON.encode(new_session), expiry_options
+      else
+        encrypted_and_signed_value = enc.encrypt_and_sign ActiveSupport::JSON.encode(new_session)
+      end
 
       raise ActionDispatch::Cookies::CookieOverflow if encrypted_and_signed_value.bytesize > ActionDispatch::Cookies::MAX_COOKIE_SIZE
 
@@ -36,22 +38,30 @@ module MultiSession
     end
 
     def update_expiration
-      Rails.application.credentials[:multi_session_keys].each_key do |key|
+      multi_session_keys.each_key do |key|
         self[key] = self[key] # decrypt and re-encrypt to force expires_at to update
       end
     end
 
     private
 
+    def multi_session_keys
+      keys = if Rails.application.respond_to? :credentials
+        Rails.application.credentials[:multi_session_keys]
+      else
+        Rails.application.secrets[:multi_session_keys]
+      end
+      keys.symbolize_keys
+    end
+
     def encryptor key
-      secret_key_base = Rails.application.credentials[:multi_session_keys][key.to_sym]
+      secret_key_base = multi_session_keys[key.to_sym]
       raise ArgumentError.new("Rails.application.credentials[:multi_session_keys][:'#{key}'] has not been set.") unless secret_key_base.present?
 
       encrypted_cookie_cipher = 'aes-256-gcm'
       key_generator = ActiveSupport::CachingKeyGenerator.new ActiveSupport::KeyGenerator.new(secret_key_base, iterations: 1000)
       key_len = ActiveSupport::MessageEncryptor.key_len encrypted_cookie_cipher
-      salt = 'authenticated encrypted cookie'
-      secret = key_generator.generate_key(MultiSession.authenticated_encrypted_cookie_salt, key_len)
+      secret = key_generator.generate_key MultiSession.authenticated_encrypted_cookie_salt, key_len
 
       ActiveSupport::MessageEncryptor.new secret, cipher: encrypted_cookie_cipher, serializer: ActiveSupport::MessageEncryptor::NullSerializer
     end

data/lib/multi_session/version.rb

@@ -1,3 +1,3 @@
 module MultiSession
-  VERSION = '1.1.0'
+  VERSION = '1.1.1'
 end

data/spec/dummy/log/test.log

@@ -394,3 +394,130 @@ Started GET "/encrypt_multi_sessions?session_values[aaaa]=alpha" for 127.0.0.1 a
 Processing by MultiSessionTestController#encrypt_multi_sessions as HTML
   Parameters: {"session_values"=>{"aaaa"=>"alpha"}}
 Completed 200 OK in 37ms
+Started GET "/" for 127.0.0.1 at 2018-10-11 10:28:33 -0500
+Processing by MultiSessionTestController#some_action as HTML
+  Rendering multi_session_test/some_action.html.erb within layouts/application
+  Rendered multi_session_test/some_action.html.erb within layouts/application (1.0ms)
+Completed 200 OK in 10ms (Views: 7.9ms)
+Started GET "/encrypt_multi_sessions?session_values[aaaa]=alpha&session_values[bbbb]=bravo&session_values[cccc]=charlie&session_values[dddd]=delta&session_values[eeee]=echo" for 127.0.0.1 at 2018-10-11 10:28:33 -0500
+Processing by MultiSessionTestController#encrypt_multi_sessions as HTML
+  Parameters: {"session_values"=>{"aaaa"=>"alpha", "bbbb"=>"bravo", "cccc"=>"charlie", "dddd"=>"delta", "eeee"=>"echo"}}
+Completed 200 OK in 15ms
+Started GET "/decrypt_multi_sessions?session_keys[]=aaaa&session_keys[]=bbbb&session_keys[]=cccc&session_keys[]=dddd&session_keys[]=eeee" for 127.0.0.1 at 2018-10-11 10:28:33 -0500
+Processing by MultiSessionTestController#decrypt_multi_sessions as HTML
+  Parameters: {"session_keys"=>["aaaa", "bbbb", "cccc", "dddd", "eeee"]}
+  Rendering inline template
+  Rendered inline template (0.2ms)
+Completed 200 OK in 10ms (Views: 0.6ms)
+Started GET "/encrypt_multi_sessions?session_values[aaaa]=alpha" for 127.0.0.1 at 2018-10-11 10:28:33 -0500
+Processing by MultiSessionTestController#encrypt_multi_sessions as HTML
+  Parameters: {"session_values"=>{"aaaa"=>"alpha"}}
+Completed 200 OK in 47ms
+Started GET "/" for 127.0.0.1 at 2018-10-11 10:32:41 -0500
+Processing by MultiSessionTestController#some_action as HTML
+  Rendering multi_session_test/some_action.html.erb within layouts/application
+  Rendered multi_session_test/some_action.html.erb within layouts/application (0.8ms)
+Completed 200 OK in 9ms (Views: 7.1ms)
+Started GET "/encrypt_multi_sessions?session_values[aaaa]=alpha&session_values[bbbb]=bravo&session_values[cccc]=charlie&session_values[dddd]=delta&session_values[eeee]=echo" for 127.0.0.1 at 2018-10-11 10:32:41 -0500
+Processing by MultiSessionTestController#encrypt_multi_sessions as HTML
+  Parameters: {"session_values"=>{"aaaa"=>"alpha", "bbbb"=>"bravo", "cccc"=>"charlie", "dddd"=>"delta", "eeee"=>"echo"}}
+Completed 500 Internal Server Error in 8ms
+Started GET "/encrypt_multi_sessions?session_values[aaaa]=alpha" for 127.0.0.1 at 2018-10-11 10:32:41 -0500
+Processing by MultiSessionTestController#encrypt_multi_sessions as HTML
+  Parameters: {"session_values"=>{"aaaa"=>"alpha"}}
+Completed 500 Internal Server Error in 0ms
+Started GET "/" for 127.0.0.1 at 2018-10-11 10:34:15 -0500
+Processing by MultiSessionTestController#some_action as HTML
+  Rendering multi_session_test/some_action.html.erb within layouts/application
+  Rendered multi_session_test/some_action.html.erb within layouts/application (1.4ms)
+Completed 200 OK in 11ms (Views: 9.5ms)
+Started GET "/encrypt_multi_sessions?session_values[aaaa]=alpha&session_values[bbbb]=bravo&session_values[cccc]=charlie&session_values[dddd]=delta&session_values[eeee]=echo" for 127.0.0.1 at 2018-10-11 10:34:15 -0500
+Processing by MultiSessionTestController#encrypt_multi_sessions as HTML
+  Parameters: {"session_values"=>{"aaaa"=>"alpha", "bbbb"=>"bravo", "cccc"=>"charlie", "dddd"=>"delta", "eeee"=>"echo"}}
+Completed 200 OK in 19ms
+Started GET "/decrypt_multi_sessions?session_keys[]=aaaa&session_keys[]=bbbb&session_keys[]=cccc&session_keys[]=dddd&session_keys[]=eeee" for 127.0.0.1 at 2018-10-11 10:34:15 -0500
+Processing by MultiSessionTestController#decrypt_multi_sessions as HTML
+  Parameters: {"session_keys"=>["aaaa", "bbbb", "cccc", "dddd", "eeee"]}
+  Rendering inline template
+  Rendered inline template (0.2ms)
+Completed 200 OK in 14ms (Views: 0.6ms)
+Started GET "/encrypt_multi_sessions?session_values[aaaa]=alpha" for 127.0.0.1 at 2018-10-11 10:34:15 -0500
+Processing by MultiSessionTestController#encrypt_multi_sessions as HTML
+  Parameters: {"session_values"=>{"aaaa"=>"alpha"}}
+Completed 200 OK in 44ms
+Started GET "/" for 127.0.0.1 at 2018-10-11 10:46:32 -0500
+Processing by MultiSessionTestController#some_action as HTML
+  Rendering multi_session_test/some_action.html.erb within layouts/application
+  Rendered multi_session_test/some_action.html.erb within layouts/application (1.1ms)
+Completed 200 OK in 9ms (Views: 6.9ms)
+Started GET "/encrypt_multi_sessions?session_values[aaaa]=alpha&session_values[bbbb]=bravo&session_values[cccc]=charlie&session_values[dddd]=delta&session_values[eeee]=echo" for 127.0.0.1 at 2018-10-11 10:46:32 -0500
+Processing by MultiSessionTestController#encrypt_multi_sessions as HTML
+  Parameters: {"session_values"=>{"aaaa"=>"alpha", "bbbb"=>"bravo", "cccc"=>"charlie", "dddd"=>"delta", "eeee"=>"echo"}}
+Completed 200 OK in 13ms
+Started GET "/decrypt_multi_sessions?session_keys[]=aaaa&session_keys[]=bbbb&session_keys[]=cccc&session_keys[]=dddd&session_keys[]=eeee" for 127.0.0.1 at 2018-10-11 10:46:32 -0500
+Processing by MultiSessionTestController#decrypt_multi_sessions as HTML
+  Parameters: {"session_keys"=>["aaaa", "bbbb", "cccc", "dddd", "eeee"]}
+  Rendering inline template
+  Rendered inline template (0.2ms)
+Completed 200 OK in 19ms (Views: 0.6ms)
+Started GET "/encrypt_multi_sessions?session_values[aaaa]=alpha" for 127.0.0.1 at 2018-10-11 10:46:32 -0500
+Processing by MultiSessionTestController#encrypt_multi_sessions as HTML
+  Parameters: {"session_values"=>{"aaaa"=>"alpha"}}
+Completed 200 OK in 40ms
+Started GET "/" for 127.0.0.1 at 2018-10-12 09:39:57 -0500
+Processing by MultiSessionTestController#some_action as HTML
+  Rendering multi_session_test/some_action.html.erb within layouts/application
+  Rendered multi_session_test/some_action.html.erb within layouts/application (1.1ms)
+Completed 200 OK in 11ms (Views: 8.3ms)
+Started GET "/encrypt_multi_sessions?session_values[aaaa]=alpha&session_values[bbbb]=bravo&session_values[cccc]=charlie&session_values[dddd]=delta&session_values[eeee]=echo" for 127.0.0.1 at 2018-10-12 09:39:57 -0500
+Processing by MultiSessionTestController#encrypt_multi_sessions as HTML
+  Parameters: {"session_values"=>{"aaaa"=>"alpha", "bbbb"=>"bravo", "cccc"=>"charlie", "dddd"=>"delta", "eeee"=>"echo"}}
+Completed 200 OK in 17ms
+Started GET "/decrypt_multi_sessions?session_keys[]=aaaa&session_keys[]=bbbb&session_keys[]=cccc&session_keys[]=dddd&session_keys[]=eeee" for 127.0.0.1 at 2018-10-12 09:39:57 -0500
+Processing by MultiSessionTestController#decrypt_multi_sessions as HTML
+  Parameters: {"session_keys"=>["aaaa", "bbbb", "cccc", "dddd", "eeee"]}
+  Rendering inline template
+  Rendered inline template (0.5ms)
+Completed 200 OK in 12ms (Views: 0.9ms)
+Started GET "/encrypt_multi_sessions?session_values[aaaa]=alpha" for 127.0.0.1 at 2018-10-12 09:39:57 -0500
+Processing by MultiSessionTestController#encrypt_multi_sessions as HTML
+  Parameters: {"session_values"=>{"aaaa"=>"alpha"}}
+Completed 200 OK in 37ms
+Started GET "/" for 127.0.0.1 at 2018-10-12 09:47:07 -0500
+Processing by MultiSessionTestController#some_action as HTML
+  Rendering multi_session_test/some_action.html.erb within layouts/application
+  Rendered multi_session_test/some_action.html.erb within layouts/application (0.7ms)
+Completed 200 OK in 8ms (Views: 6.1ms)
+Started GET "/encrypt_multi_sessions?session_values[aaaa]=alpha&session_values[bbbb]=bravo&session_values[cccc]=charlie&session_values[dddd]=delta&session_values[eeee]=echo" for 127.0.0.1 at 2018-10-12 09:47:07 -0500
+Processing by MultiSessionTestController#encrypt_multi_sessions as HTML
+  Parameters: {"session_values"=>{"aaaa"=>"alpha", "bbbb"=>"bravo", "cccc"=>"charlie", "dddd"=>"delta", "eeee"=>"echo"}}
+Completed 200 OK in 12ms
+Started GET "/decrypt_multi_sessions?session_keys[]=aaaa&session_keys[]=bbbb&session_keys[]=cccc&session_keys[]=dddd&session_keys[]=eeee" for 127.0.0.1 at 2018-10-12 09:47:07 -0500
+Processing by MultiSessionTestController#decrypt_multi_sessions as HTML
+  Parameters: {"session_keys"=>["aaaa", "bbbb", "cccc", "dddd", "eeee"]}
+  Rendering inline template
+  Rendered inline template (0.2ms)
+Completed 200 OK in 11ms (Views: 0.8ms)
+Started GET "/encrypt_multi_sessions?session_values[aaaa]=alpha" for 127.0.0.1 at 2018-10-12 09:47:07 -0500
+Processing by MultiSessionTestController#encrypt_multi_sessions as HTML
+  Parameters: {"session_values"=>{"aaaa"=>"alpha"}}
+Completed 200 OK in 33ms
+Started GET "/" for 127.0.0.1 at 2018-10-12 09:47:43 -0500
+Processing by MultiSessionTestController#some_action as HTML
+  Rendering multi_session_test/some_action.html.erb within layouts/application
+  Rendered multi_session_test/some_action.html.erb within layouts/application (0.8ms)
+Completed 200 OK in 8ms (Views: 6.1ms)
+Started GET "/encrypt_multi_sessions?session_values[aaaa]=alpha&session_values[bbbb]=bravo&session_values[cccc]=charlie&session_values[dddd]=delta&session_values[eeee]=echo" for 127.0.0.1 at 2018-10-12 09:47:43 -0500
+Processing by MultiSessionTestController#encrypt_multi_sessions as HTML
+  Parameters: {"session_values"=>{"aaaa"=>"alpha", "bbbb"=>"bravo", "cccc"=>"charlie", "dddd"=>"delta", "eeee"=>"echo"}}
+Completed 200 OK in 12ms
+Started GET "/decrypt_multi_sessions?session_keys[]=aaaa&session_keys[]=bbbb&session_keys[]=cccc&session_keys[]=dddd&session_keys[]=eeee" for 127.0.0.1 at 2018-10-12 09:47:43 -0500
+Processing by MultiSessionTestController#decrypt_multi_sessions as HTML
+  Parameters: {"session_keys"=>["aaaa", "bbbb", "cccc", "dddd", "eeee"]}
+  Rendering inline template
+  Rendered inline template (0.2ms)
+Completed 200 OK in 10ms (Views: 0.6ms)
+Started GET "/encrypt_multi_sessions?session_values[aaaa]=alpha" for 127.0.0.1 at 2018-10-12 09:47:43 -0500
+Processing by MultiSessionTestController#encrypt_multi_sessions as HTML
+  Parameters: {"session_values"=>{"aaaa"=>"alpha"}}
+Completed 200 OK in 33ms

metadata

@@ -1,29 +1,29 @@
 --- !ruby/object:Gem::Specification
 name: multi_session
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.1.1
 platform: ruby
 authors:
 - Sean Huber
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-10-10 00:00:00.000000000 Z
+date: 2018-10-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 5.2.1
+        version: 5.2.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 5.2.1
+        version: 5.2.0
 - !ruby/object:Gem::Dependency
   name: coveralls
   requirement: !ruby/object:Gem::Requirement