rack-cors-csrf_prevention 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 875f008ae969331b4266a00a131b2edf9399d24ea347c2622d9cd79eaa6fcd71
-  data.tar.gz: 7de16bb4d69a5783829281c312290c94ec5b544963c45bc03ae38942968eb795
+  metadata.gz: bf73e75d0b552d217b4a9cb9aabf5f08eb16db81b864a452a61388bd39d41f5c
+  data.tar.gz: 6daf069995fda9f4b8af289a3b6cf3a009a839ba95d6267d0167b9e98484ba81
 SHA512:
-  metadata.gz: fb20827ff14fa2a57ac931ab263adedc4f87e0422d8ddb1c021abb4878a8023638ded968c05616ab163ce218e14e09ce2026b85101569b8afd25070f31c08635
-  data.tar.gz: f8bcbb4e2b5330e27285e3e296d9d2c6db64e6350843e2bb16d0fcef844728120237a81eed4f00f0e426d0fab98c81af349b196288df1d4550298c67a4c1a74c
+  metadata.gz: 7ab5b4cb92c9db15d97d60ab49725f7feae8aede713f678531bbd0292575e23fa9834ffb8feadbf86217d1ee19cdad9252d1f7d75bb6461ab83f1b837bf2fef2
+  data.tar.gz: 30a0e42021a6ba4eed3cf1a6d684310937dc0ee6a888e7b81ccc8a02db889afbf3fcb0fbc532ef453951cc51696845c6d2d34fd74d21a4a96ffe886b14a4e1c0

data/Gemfile.lock

@@ -1,15 +1,28 @@
 PATH
   remote: .
   specs:
-    rack-cors-csrf_prevention (0.1.0)
+    rack-cors-csrf_prevention (0.2.0)
       rack (>= 1)
 
 GEM
   remote: https://rubygems.org/
   specs:
+    debug (1.9.1)
+      irb (~> 1.10)
+      reline (>= 0.3.8)
     diff-lcs (1.5.0)
+    io-console (0.7.2)
+    irb (1.11.2)
+      rdoc
+      reline (>= 0.4.2)
+    psych (5.1.2)
+      stringio
     rack (2.2.7)
     rake (13.0.6)
+    rdoc (6.6.2)
+      psych (>= 4.0.0)
+    reline (0.4.2)
+      io-console (~> 0.5)
     rspec (3.12.0)
       rspec-core (~> 3.12.0)
       rspec-expectations (~> 3.12.0)
@@ -23,12 +36,14 @@ GEM
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.12.0)
     rspec-support (3.12.0)
+    stringio (3.1.0)
 
 PLATFORMS
   arm64-darwin-22
   x86_64-linux
 
 DEPENDENCIES
+  debug (~> 1.9, >= 1.9.1)
   rack-cors-csrf_prevention!
   rake (~> 13.0)
   rspec (~> 3.0)

data/README.md

@@ -20,29 +20,26 @@ gem install rack-cors-csrf_prevention
 
 ### Rails Configuration
 
-Specify paths for CSRF prevention:
-
 ```ruby
 # config/initializers/cors.rb
 
-Rails.application.config.middleware.use Rack::Cors::CsrfPrevention,
-                                        paths: %w[/graphql]
+Rails.application.config.middleware.use Rack::Cors::CsrfPrevention
 ```
 
-You can also specify custom headers that allow execution. By default, it's `X-Apollo-Operation-Name` or `Apollo-Require-Preflight` headers, but you can configure to allow a `Some-Special-Header` header:
+By default, gem protects path `/graphql` and allows only `X-Apollo-Operation-Name` or `Apollo-Require-Preflight` header for non-preflighted content types.
+
+You can customize path and headers for CSRF prevention:
 
 ```ruby
 # config/initializers/cors.rb
 
 Rails.application.config.middleware.use Rack::Cors::CsrfPrevention,
-                                        paths: %w[/graphql],
-                                        required_headers: %w[
-                                          X-APOLLO-OPERATION-NAME
-                                          APOLLO-REQUIRE-PREFLIGHT
-                                          SOME-SPECIAL-HEADER
-                                        ]
+                                        path: "/gql",
+                                        required_headers: %w[SOME-SPECIAL-HEADER]
 ```
 
+Also, you can configure multiple paths via `paths` argument.
+
 ## Development
 
 After checking out the repo, run `bin/setup` to install dependencies. Then, run

data/lib/rack/cors/csrf_prevention/version.rb

@@ -3,7 +3,7 @@
 module Rack
   class Cors
     class CsrfPrevention
-      VERSION = "0.1.0"
+      VERSION = "0.2.0"
     end
   end
 end

data/lib/rack/cors/csrf_prevention.rb

@@ -28,12 +28,13 @@ module Rack
 
       def initialize(
         app,
-        paths:,
-        required_headers: APOLLO_CUSTOM_PREFLIGHT_HEADERS
+        path: nil,
+        paths: [],
+        required_headers: []
       )
         @app = app
-        @paths = paths
-        @required_headers = required_headers
+        @paths = path.nil? && paths.empty? ? ["/graphql"] : [path].compact + paths
+        @required_headers = APOLLO_CUSTOM_PREFLIGHT_HEADERS + required_headers
       end
 
       def call(env)

data/rack-cors-csrf_prevention.gemspec

@@ -51,6 +51,6 @@ Gem::Specification.new do |spec|
   spec.add_dependency "rack", ">= 1"
 
   spec.add_development_dependency "rake", "~> 13.0"
-  # spec.add_development_dependency "minitest", "~> 5.0"
   spec.add_development_dependency "rspec", "~> 3.0"
+  spec.add_development_dependency "debug", "~> 1.9", ">= 1.9.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack-cors-csrf_prevention
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Digital Classifieds LLC
@@ -52,6 +52,26 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3.0'
+- !ruby/object:Gem::Dependency
+  name: debug
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.9'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.9.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.9'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.9.1
 description: |
   The middleware makes sure any request to specified paths would have been
   preflighted if it was sent by a browser.