rack-auth-cookie 0.5.0 → 0.5.1

data/lib/rack/auth/cookie.rb

@@ -55,11 +55,14 @@ module Rack
           return finish(@app, env, cookie_value)
         end
         
-        if hash_data["AUTH_EXPIRE_DATETIME"] < Time.now.utc
+        auth_datetime = Time.at(hash_data['AUTH_DATETIME']).utc
+        auth_expire_datetime = Time.at(hash_data['AUTH_EXPIRE_DATETIME']).utc
+        
+        if auth_expire_datetime < Time.now.utc
           auth_fail = "Timed out due to inactivity"
         end
         
-        if hash_data["AUTH_DATETIME"] + @@max_lifetime < Time.now.utc
+        if auth_datetime + @@max_lifetime < Time.now.utc
           auth_fail = "Maximum session length exceeded"
         end
         
@@ -74,8 +77,8 @@ module Rack
           
           env['AUTH_TYPE_THIS_REQUEST'] = "Cookie"
           
-          env['AUTH_DATETIME'] = Time.at(hash_data['AUTH_DATETIME']).utc
-          env['AUTH_EXPIRE_DATETIME'] = Time.at(hash_data['AUTH_EXPIRE_DATETIME']).utc
+          env['AUTH_DATETIME'] = auth_datetime
+          env['AUTH_EXPIRE_DATETIME'] = auth_expire_datetime
         end
         
         finish(@app, env, cookie_value)
@@ -99,11 +102,22 @@ module Rack
           end
         end
         
-        # If the application isn't making any changes to the cookie, we can mess with it
+        # If the application isn't making any changes to the cookie, we can modify it
         if cookie_value_from_request && !response_cookie
-          cookie = self.class.create_auth_cookie(env)
           
-          headers["Set-Cookie"] << cookie
+          # If authentication succeeded earlier, send back a new token
+          if env['AUTH_USER']
+            cookie = self.class.create_auth_cookie(env)
+            
+            headers["Set-Cookie"] << cookie
+          end
+          
+          # If authentication failed earlier, tell the client to clear the cookie
+          if env['AUTH_FAIL']
+            cookie = self.class.create_clear_cookie(env)
+            
+            headers["Set-Cookie"] << cookie
+          end
         end
         
         [status, headers, body]
@@ -167,6 +181,15 @@ module Rack
         cookie += "HttpOnly; "
       end
       
+      def self.create_clear_cookie(env)
+        cookie_value = ""
+        cookie = "#{@@cookie_name}=; "
+        cookie += "domain=.#{top_level_domain(env)}; "
+        cookie += "path=/; "
+        cookie += "expires=Thu, 01-Jan-1970 00:00:00 GMT; "
+        cookie += "HttpOnly; "
+      end
+      
       def self.generate_hmac(data)
         OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA1.new, @@secret, data)
       end

data/rack-auth-cookie.gemspec

@@ -2,7 +2,7 @@ require 'rubygems'
 
 Gem::Specification.new do |gem|
   gem.name      = 'rack-auth-cookie'
-  gem.version   = '0.5.0'
+  gem.version   = '0.5.1'
   gem.authors   = ["Daniel Berger", "Charlie O'Keefe"]
   gem.email     = 'cokeefe@globe.gov'
   gem.homepage  = 'http://www.github.com/charlieok/rack-auth-cookie'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: rack-auth-cookie
 version: !ruby/object:Gem::Version 
-  version: 0.5.0
+  version: 0.5.1
 platform: ruby
 authors: 
 - Daniel Berger