rack-potentially-secure-cookies 1.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 097d2b73a2a3f4918b9c72fa010efc2eb931a25f
+  data.tar.gz: 4c1a16a283d75cfd097252b1c623aeec4a1da1a3
+SHA512:
+  metadata.gz: 63d7f71c2f025c7c30bc1a5b39b7541c633192d12b10e99cf2fe85433877ea83736057eca7288965a936137cc050d721293d21a6c569f1a2dc6f8920d59185db
+  data.tar.gz: 38310b5cbe94927af0286ceb9aea34de8d00229dd0fa0fe68aa5fcb2c427d64d141b8cdd8736d3cd23e5a8e399143d30154cfa1c14939fd3b1bc9dc7088e9a28

data/MIT-LICENSE

@@ -0,0 +1,20 @@
+Copyright 2015 YOURNAME
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,44 @@
+# Rack::PotentiallySecureCookie
+
+This is a Rack middleware for one very specific purpose;
+
+You have a site running on a server that can be accessed through both HTTP and
+HTTPS. Whichever method the user accesses the site she'll never change. So if
+you access the site the first time through HTTPS you will continue to do so.
+
+Because security we needed a way to ensure that the cookie flag `Secure` was
+being set whenever our users accesses the site through HTTPS, and to ensure it
+was *not* set when accessing through HTTP as the users couldn't login then.
+
+An example of this is:
+
+* The site is running on a secured server deep in the middle of a datacenter
+* This site serves the public internet and because of this there's SSL
+  termination in front of the site
+* The same site is also being used internally at the company, under a split-view
+  setup and these users are not able to go through the SSL termination
+* Since it would be wasteful to run the server with multiple instances of the
+  app only to configure the secure cookie setting something to dynamically set
+  this needed to be done
+
+## Installation and configuration
+
+This is available as a gem so just add to your `Gemfile`:
+
+```ruby
+gem 'rack-potentially-secure-cookies', require: 'rack/potentially_secure_cookies'
+```
+
+In your `environment.rb` (or maybe `environments/production.rb`) add the middleware:
+
+```ruby
+config.middleware.insert_before(ActionDispatch::Cookies,
+                                Rack::PotentiallySecureCookies,
+                                ['_session_id'])
+```
+
+The last argument is an array of cookies to force this configuration on.
+
+## License
+
+MIT License

data/Rakefile

@@ -0,0 +1,13 @@
+begin
+  require 'bundler/setup'
+rescue LoadError
+  puts 'You must `gem install bundler` and `bundle install` to run rake tasks'
+end
+require 'rspec/core/rake_task'
+
+Bundler::GemHelper.install_tasks
+
+RSpec::Core::RakeTask.new(:spec) do |t|
+  t.rspec_opts = '--format documentation'
+end
+task :default => :spec

data/lib/rack/potentially_secure_cookies.rb

@@ -0,0 +1,33 @@
+module Rack
+  class PotentiallySecureCookies
+    VERSION = '1.0.1'
+
+    def initialize(app, cookies)
+      @app = app
+
+      # All in the name to make this as fast as possible anything that
+      # could be used in multiple requests have been defined here.
+      _cookies = "^((#{cookies.join(')|(')}))".freeze
+      @configured_cookies = /#{_cookies}/
+      @cookies_with_secure = /(#{_cookies}.*?)(; [Ss]ecure)(.*)$/
+      @cookies_without_secure = /(#{_cookies}(?!.*[Ss]ecure).*)/
+      @secure = /; [Ss]ecure/
+    end
+
+    def call(env)
+      status, headers, body = @app.call(env)
+
+      if headers['Set-Cookie'] && @configured_cookies.match(headers['Set-Cookie'])
+        request = Rack::Request.new(env)
+
+        if request.ssl?
+          headers['Set-Cookie'].gsub!(@cookies_without_secure, '\1; Secure')
+        else
+          headers['Set-Cookie'].gsub!(@cookies_with_secure, '\1\3')
+        end
+      end
+
+      [status, headers, body]
+    end
+  end
+end

metadata

@@ -0,0 +1,63 @@
+--- !ruby/object:Gem::Specification
+name: rack-potentially-secure-cookies
+version: !ruby/object:Gem::Version
+  version: 1.0.1
+platform: ruby
+authors:
+- Björn Andersson
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2015-12-10 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: 
+email:
+- ba@sanitarium.se
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- MIT-LICENSE
+- README.md
+- Rakefile
+- lib/rack/potentially_secure_cookies.rb
+homepage: https://github.com/gaqzi/rack-potentially-secure-cookies
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.2.5
+signing_key: 
+specification_version: 4
+summary: Force the secure bit of a cookie depending on whether your connection is
+  secure
+test_files: []