quilt_rails 1.10.0 → 1.11.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f4580b1b1870a7fb2afa9bc64bab975e8ec3c7041f775de16356d31151ab4768
-  data.tar.gz: 8914278b57d9bb8bad32c33c2e9697289073fe80576248b08bfe60f0b6f2536d
+  metadata.gz: 0375ff704f3b5de3a726c3483e1aee2808871d0979a6e4a35f03d490ad5f9c47
+  data.tar.gz: 6ccb28ab1d0ac38f149922668ef43acfa5c43811a2b4c683772d28243614d6e9
 SHA512:
-  metadata.gz: e908b7d01e781f43ccf9c3a21d595aef8fffb612fe5da76d29f1cbef9a635ef5cbd8b8b29e6e9cbd8a9bdf170ac7fbabe7a4e0c8880a3bd81a90fde2d2da5a03
-  data.tar.gz: 66fe45a859a30dde3a31e76563cb6d5ef5c0d6621f9127cb1a41c270dde190b47227a5d31bcca81bdb26098e172a67e811d7c58c551a74fa8b7d6d8e0d1968bb
+  metadata.gz: 6999712f3a0bab58d7e824f2d9caf3570385e613cf77dc7adcc24eda499464a923bcfdbe9fb5caa64c2647448e1d49c89e4e932a6e49d2479cbbc7a6ff42ab0a
+  data.tar.gz: 60013d5daf244057e5edf7c21f1fdadc8eefb5ff966fba8754077ae07af0a228f6aa5ea70f962f0af80044e20729af5d2a6ed8e41ec70039520c80d44716e245

data/README.md

@@ -91,6 +91,9 @@ An application can also be setup manually using the following steps.
 #### Install dependencies
 
 ```sh
+# Add ruby dependencies
+bundle add sewing_kit quilt_rails
+
 # Add core Node dependencies
 yarn add @shopify/sewing-kit @shopify/react-server
 
@@ -387,55 +390,50 @@ With SSR enabled React apps, state must be serialized on the server and deserial
 
 #### Customizing the node server
 
-By default, sewing-kit bundles in `@shopify/react-server-webpack-plugin` for `quilt_rails` applications to get apps up and running fast without needing to manually write any node server code. If what it provides is not sufficient, a custom server can be defined by adding a `server.js` or `server.ts` file to the app folder.
+By default, sewing-kit bundles in [`@shopify/react-server-webpack-plugin`](../../packages/react-server-webpack-plugin/README.md) for `quilt_rails` applications to get apps up and running fast without needing to manually write any node server code.
+
+If what it provides is not sufficient, a completely custom server can be defined by adding a `server.js` or `server.ts` file to the `app/ui` folder. The simplest way to customize the server is to export the object created by [`@shopify/react-server`](../../packages/react-server/README.md#node-usage)'s `createServer` call in `server.ts` file.
 
 ```
-└── app
+└── appeon
    └── ui
       └─- app.{js|ts}x
       └─- index.{js|ts}
       └─- server.{js|ts}x
 ```
 
-```tsx
-// app/ui/server.tsx
-import '@shopify/polyfills/fetch';
-import {createServer} from '@shopify/react-server';
-import {Context} from 'koa';
-import React from 'react';
+#### Fixing rejected CSRF tokens for new user sessions
 
-import App from './app';
-
-// The simplest way to build a custom server that will work with this library is to use the APIs provided by @shopify/react-server.
-// https://github.com/Shopify/quilt/blob/master/packages/react-server/README.md#L8
-const app = createServer({
-  port: process.env.PORT ? parseInt(process.env.PORT, 10) : 8081,
-  ip: process.env.IP,
-  assetPrefix: process.env.CDN_URL || 'localhost:8080/assets/webpack',
-  render: (ctx, {locale}) => {
-    const whatever = /* do something special with the koa context */;
-    // any special data we add to the incoming request in our rails controller we can access here to pass into our component
-    return <App server someCustomProp={whatever} location={ctx.request.url} locale={locale} />;
-  },
-});
+When a React component sends HTTP requests back to a Rails endpoint (e.g., `/graphql`), Rails may throw a `Can't verify CSRF token authenticity` exception. This stems from the Rails CSRF tokens not persisting until after the first `UiController` call ends.
 
-export default app;
-```
+If your API **does not** require session data, the easiest way to deal with this is to use `protect_from_forgery with: :null_session`. This will work for APIs that either have no authentication requirements, or use header based authentication.
 
-#### Fixing rejected CSRF tokens for new user sessions
+##### Example
+
+```rb
+class GraphqlController < ApplicationController
+  protect_from_forgery with: :null_session
 
-If a React component calls back to a Rails endpoint (e.g., `/graphql`), Rails may throw a `Can't verify CSRF token authenticity` exception. This stems from the Rails CSRF tokens not persisting until after the first `UiController` call ends.
+  def execute
+    # Get GraphQL query, etc
 
-To fix this:
+    result = MySchema.execute(query, operation_name: operation_name, variables: variables, context: context)
 
-- Add an `X-Shopify-Server-Side-Rendered: 1` header to all server-side GraphQL requests
-- Add a `protect_from_forgery with: Quilt::TrustedUiServerCsrfStrategy` override to Node-accessed controllers
+    render(json: result)
+  end
+end
+```
+
+If your API **does** require session data, you may can use follow the following steps:
 
-e.g.:
+- Add an `x-shopify-react-xhr` header to all GraphQL requests with a value of 1 (this is done automatically if you are using `@shopify/react-graphql-universal-provider`)
+- Add a `protect_from_forgery with: Quilt::HeaderCsrfStrategy` override to your controllers
+
+##### Example
 
 ```rb
 class GraphqlController < ApplicationController
-  protect_from_forgery with: Quilt::TrustedUiServerCsrfStrategy
+  protect_from_forgery with: Quilt::HeaderCsrfStrategy
 
   def execute
     # Get GraphQL query, etc
@@ -447,6 +445,8 @@ class GraphqlController < ApplicationController
 end
 ```
 
+-
+
 ## Performance tracking a React app
 
 Using [`Quilt::Performance::Reportable`](#performanceReportable) and [@shopify/react-performance](https://www.npmjs.com/package/@shopify/react-performance) it's easy to add performance tracking to apps using[`sewing_kit`](https://github.com/Shopify/sewing-kit/tree/master/gems/sewing_kit#sewing_kit-) for client-side-rendering or `quilt_rails` for server-side-rendering.

data/lib/quilt_rails/header_csrf_strategy.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module Quilt
+  class HeaderCsrfStrategy
+    HEADER = "x-shopify-react-xhr"
+    HEADER_VALUE = "1"
+
+    def initialize(controller)
+      @controller = controller
+    end
+
+    def handle_unverified_request
+      raise NoSameSiteHeaderError unless same_site?
+    end
+
+    private
+
+    def same_site?
+      @controller.request.headers[HEADER] == HEADER_VALUE
+    end
+
+    def fallback_handler
+      ActionController::RequestForgeryProtection::ProtectionMethods::Exception.new(@controller)
+    end
+
+    class NoSameSiteHeaderError < StandardError
+      def initialize
+        # rubocop:disable LineLength
+        super "CSRF verification failed. This request is missing the `x-shopify-react-xhr` header, or it does not have the expected value."
+        # rubocop:enable LineLength
+      end
+    end
+  end
+end

data/lib/quilt_rails/version.rb

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 module Quilt
-  VERSION = "1.10.0"
+  VERSION = "1.11.1"
 end

data/lib/quilt_rails.rb

@@ -9,4 +9,5 @@ require "quilt_rails/configuration"
 require "quilt_rails/react_renderable"
 require "quilt_rails/performance"
 require "quilt_rails/trusted_ui_server_csrf_strategy"
+require "quilt_rails/header_csrf_strategy"
 require "quilt_rails/monkey_patches/active_support_reloader" if Rails.env.development?

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: quilt_rails
 version: !ruby/object:Gem::Version
-  version: 1.10.0
+  version: 1.11.1
 platform: ruby
 authors:
 - Mathew Allen
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-01-30 00:00:00.000000000 Z
+date: 2020-03-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -104,6 +104,7 @@ files:
 - lib/quilt_rails.rb
 - lib/quilt_rails/configuration.rb
 - lib/quilt_rails/engine.rb
+- lib/quilt_rails/header_csrf_strategy.rb
 - lib/quilt_rails/logger.rb
 - lib/quilt_rails/monkey_patches/active_support_reloader.rb
 - lib/quilt_rails/performance.rb
@@ -121,7 +122,8 @@ files:
 homepage: https://github.com/Shopify/quilt/tree/master/gems/quilt_rails
 licenses:
 - MIT
-metadata: {}
+metadata:
+  allowed_push_host: https://rubygems.org
 post_install_message: 
 rdoc_options: []
 require_paths: