rack-protection 1.5.0 → 2.0.0

data/lib/rack/protection/strict_transport.rb

@@ -0,0 +1,39 @@
+require 'rack/protection'
+
+module Rack
+  module Protection
+    ##
+    # Prevented attack::   Protects against against protocol downgrade attacks and cookie hijacking.
+    # Supported browsers:: all
+    # More infos::         https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
+    #
+    # browser will prevent any communications from being sent over HTTP
+    # to the specified domain and will instead send all communications over HTTPS.
+    # It also prevents HTTPS click through prompts on browsers.
+    #
+    # Options:
+    #
+    # max_age:: How long future requests to the domain should go over HTTPS; specified in seconds
+    # include_subdomains:: If all present and future subdomains will be HTTPS
+    # preload:: Allow this domain to be included in browsers HSTS preload list. See https://hstspreload.appspot.com/
+
+    class StrictTransport < Base
+      default_options :max_age => 31_536_000, :include_subdomains => false, :preload => false
+
+      def strict_transport
+        @strict_transport ||= begin
+          strict_transport = 'max-age=' + options[:max_age].to_s
+          strict_transport += '; includeSubDomains' if options[:include_subdomains]
+          strict_transport += '; preload' if options[:preload]
+          strict_transport.to_str
+        end
+      end
+
+      def call(env)
+        status, headers, body = @app.call(env)
+        headers['Strict-Transport-Security'] ||= strict_transport
+        [status, headers, body]
+      end
+    end
+  end
+end

data/lib/rack/protection/version.rb

@@ -1,16 +1,5 @@
 module Rack
   module Protection
-    def self.version
-      VERSION
-    end
-
-    SIGNATURE = [1, 5, 0]
-    VERSION   = SIGNATURE.join('.')
-
-    VERSION.extend Comparable
-    def VERSION.<=>(other)
-      other = other.split('.').map { |i| i.to_i } if other.respond_to? :split
-      SIGNATURE <=> Array(other)
-    end
+    VERSION = '2.0.0'
   end
 end

data/lib/rack/protection/xss_header.rb

@@ -4,7 +4,7 @@ module Rack
   module Protection
     ##
     # Prevented attack::   Non-permanent XSS
-    # Supported browsers:: Internet Explorer 8 and later
+    # Supported browsers:: Internet Explorer 8+ and Chrome
     # More infos::         http://blogs.msdn.com/b/ie/archive/2008/07/01/ie8-security-part-iv-the-xss-filter.aspx
     #
     # Sets X-XSS-Protection header to tell the browser to block attacks.

data/lib/rack/protection.rb

@@ -3,36 +3,50 @@ require 'rack'
 
 module Rack
   module Protection
-    autoload :AuthenticityToken, 'rack/protection/authenticity_token'
-    autoload :Base,              'rack/protection/base'
-    autoload :EscapedParams,     'rack/protection/escaped_params'
-    autoload :FormToken,         'rack/protection/form_token'
-    autoload :FrameOptions,      'rack/protection/frame_options'
-    autoload :HttpOrigin,        'rack/protection/http_origin'
-    autoload :IPSpoofing,        'rack/protection/ip_spoofing'
-    autoload :JsonCsrf,          'rack/protection/json_csrf'
-    autoload :PathTraversal,     'rack/protection/path_traversal'
-    autoload :RemoteReferrer,    'rack/protection/remote_referrer'
-    autoload :RemoteToken,       'rack/protection/remote_token'
-    autoload :SessionHijacking,  'rack/protection/session_hijacking'
-    autoload :XSSHeader,         'rack/protection/xss_header'
+    autoload :AuthenticityToken,     'rack/protection/authenticity_token'
+    autoload :Base,                  'rack/protection/base'
+    autoload :CookieTossing,         'rack/protection/cookie_tossing'
+    autoload :ContentSecurityPolicy, 'rack/protection/content_security_policy'
+    autoload :EscapedParams,         'rack/protection/escaped_params'
+    autoload :FormToken,             'rack/protection/form_token'
+    autoload :FrameOptions,          'rack/protection/frame_options'
+    autoload :HttpOrigin,            'rack/protection/http_origin'
+    autoload :IPSpoofing,            'rack/protection/ip_spoofing'
+    autoload :JsonCsrf,              'rack/protection/json_csrf'
+    autoload :PathTraversal,         'rack/protection/path_traversal'
+    autoload :RemoteReferrer,        'rack/protection/remote_referrer'
+    autoload :RemoteToken,           'rack/protection/remote_token'
+    autoload :SessionHijacking,      'rack/protection/session_hijacking'
+    autoload :StrictTransport,       'rack/protection/strict_transport'
+    autoload :XSSHeader,             'rack/protection/xss_header'
 
     def self.new(app, options = {})
       # does not include: RemoteReferrer, AuthenticityToken and FormToken
       except = Array options[:except]
       use_these = Array options[:use]
+
+      if options.fetch(:without_session, false)
+        except += [:session_hijacking, :remote_token]
+      end
+
       Rack::Builder.new do
-        use ::Rack::Protection::RemoteReferrer,   options if use_these.include? :remote_referrer
-        use ::Rack::Protection::AuthenticityToken,options if use_these.include? :authenticity_token
-        use ::Rack::Protection::FormToken,        options if use_these.include? :form_token
-        use ::Rack::Protection::FrameOptions,     options unless except.include? :frame_options
-        use ::Rack::Protection::HttpOrigin,       options unless except.include? :http_origin
-        use ::Rack::Protection::IPSpoofing,       options unless except.include? :ip_spoofing
-        use ::Rack::Protection::JsonCsrf,         options unless except.include? :json_csrf
-        use ::Rack::Protection::PathTraversal,    options unless except.include? :path_traversal
-        use ::Rack::Protection::RemoteToken,      options unless except.include? :remote_token
-        use ::Rack::Protection::SessionHijacking, options unless except.include? :session_hijacking
-        use ::Rack::Protection::XSSHeader,        options unless except.include? :xss_header
+        # Off by default, unless added
+        use ::Rack::Protection::AuthenticityToken,     options if use_these.include? :authenticity_token
+        use ::Rack::Protection::CookieTossing,         options if use_these.include? :cookie_tossing
+        use ::Rack::Protection::ContentSecurityPolicy, options if use_these.include? :content_security_policy
+        use ::Rack::Protection::FormToken,             options if use_these.include? :form_token
+        use ::Rack::Protection::RemoteReferrer,        options if use_these.include? :remote_referrer
+        use ::Rack::Protection::StrictTransport,       options if use_these.include? :strict_transport
+
+        # On by default, unless skipped
+        use ::Rack::Protection::FrameOptions,          options unless except.include? :frame_options
+        use ::Rack::Protection::HttpOrigin,            options unless except.include? :http_origin
+        use ::Rack::Protection::IPSpoofing,            options unless except.include? :ip_spoofing
+        use ::Rack::Protection::JsonCsrf,              options unless except.include? :json_csrf
+        use ::Rack::Protection::PathTraversal,         options unless except.include? :path_traversal
+        use ::Rack::Protection::RemoteToken,           options unless except.include? :remote_token
+        use ::Rack::Protection::SessionHijacking,      options unless except.include? :session_hijacking
+        use ::Rack::Protection::XSSHeader,             options unless except.include? :xss_header
         run app
       end.to_app
     end

data/rack-protection.gemspec

@@ -1,94 +1,25 @@
-# Run `rake rack-protection.gemspec` to update the gemspec.
+version = File.read(File.expand_path("../../VERSION", __FILE__)).strip
+
 Gem::Specification.new do |s|
   # general infos
   s.name        = "rack-protection"
-  s.version     = "1.5.0"
-  s.description = "You should use protection!"
-  s.homepage    = "http://github.com/rkh/rack-protection"
+  s.version     = version
+  s.description = "Protect against typical web attacks, works with all Rack apps, including Rails."
+  s.homepage    = "http://github.com/sinatra/sinatra/tree/master/rack-protection"
   s.summary     = s.description
-
-  # generated from git shortlog -sn
-  s.authors = [
-    "Konstantin Haase",
-    "Alex Rodionov",
-    "Chris Heald",
-    "Chris Mytton",
-    "Corey Ward",
-    "David Kellum",
-    "Egor Homakov",
-    "Florian Gilcher",
-    "Fojas",
-    "Mael Clerambault",
-    "Martin Mauch",
-    "SAKAI, Kazuaki",
-    "Stanislav Savulchik",
-    "Steve Agalloco",
-    "Akzhan Abdulin",
-    "TOBY",
-    "Bj\u00F8rge N\u00E6ss"
-  ]
-
-  # generated from git shortlog -sne
-  s.email = [
-    "konstantin.mailinglists@googlemail.com",
-    "p0deje@gmail.com",
-    "self@hecticjeff.net",
-    "coreyward@me.com",
-    "dek-oss@gravitext.com",
-    "homakov@gmail.com",
-    "florian.gilcher@asquera.de",
-    "developer@fojasaur.us",
-    "mael@clerambault.fr",
-    "martin.mauch@gmail.com",
-    "kaz.july.7@gmail.com",
-    "s.savulchik@gmail.com",
-    "steve.agalloco@gmail.com",
-    "akzhan.abdulin@gmail.com",
-    "toby.net.info.mail+git@gmail.com",
-    "bjoerge@bengler.no",
-    "cheald@gmail.com"
-  ]
-
-  # generated from git ls-files
-  s.files = [
+  s.license     = 'MIT'
+  s.authors     = ["https://github.com/sinatra/sinatra/graphs/contributors"]
+  s.email       = "sinatrarb@googlegroups.com"
+  s.files       = Dir["lib/**/*.rb"] + [
     "License",
     "README.md",
     "Rakefile",
-    "lib/rack-protection.rb",
-    "lib/rack/protection.rb",
-    "lib/rack/protection/authenticity_token.rb",
-    "lib/rack/protection/base.rb",
-    "lib/rack/protection/escaped_params.rb",
-    "lib/rack/protection/form_token.rb",
-    "lib/rack/protection/frame_options.rb",
-    "lib/rack/protection/http_origin.rb",
-    "lib/rack/protection/ip_spoofing.rb",
-    "lib/rack/protection/json_csrf.rb",
-    "lib/rack/protection/path_traversal.rb",
-    "lib/rack/protection/remote_referrer.rb",
-    "lib/rack/protection/remote_token.rb",
-    "lib/rack/protection/session_hijacking.rb",
-    "lib/rack/protection/version.rb",
-    "lib/rack/protection/xss_header.rb",
-    "rack-protection.gemspec",
-    "spec/authenticity_token_spec.rb",
-    "spec/escaped_params_spec.rb",
-    "spec/form_token_spec.rb",
-    "spec/frame_options_spec.rb",
-    "spec/http_origin_spec.rb",
-    "spec/ip_spoofing_spec.rb",
-    "spec/json_csrf_spec.rb",
-    "spec/path_traversal_spec.rb",
-    "spec/protection_spec.rb",
-    "spec/remote_referrer_spec.rb",
-    "spec/remote_token_spec.rb",
-    "spec/session_hijacking_spec.rb",
-    "spec/spec_helper.rb",
-    "spec/xss_header_spec.rb"
+    "Gemfile",
+    "rack-protection.gemspec"
   ]
 
   # dependencies
   s.add_dependency "rack"
   s.add_development_dependency "rack-test"
-  s.add_development_dependency "rspec", "~> 2.0"
+  s.add_development_dependency "rspec", "~> 3.0.0"
 end

metadata

@@ -1,103 +1,65 @@
 --- !ruby/object:Gem::Specification
 name: rack-protection
 version: !ruby/object:Gem::Version
-  version: 1.5.0
-  prerelease: 
+  version: 2.0.0
 platform: ruby
 authors:
-- Konstantin Haase
-- Alex Rodionov
-- Chris Heald
-- Chris Mytton
-- Corey Ward
-- David Kellum
-- Egor Homakov
-- Florian Gilcher
-- Fojas
-- Mael Clerambault
-- Martin Mauch
-- SAKAI, Kazuaki
-- Stanislav Savulchik
-- Steve Agalloco
-- Akzhan Abdulin
-- TOBY
-- Bjørge Næss
+- https://github.com/sinatra/sinatra/graphs/contributors
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-03-13 00:00:00.000000000 Z
+date: 2017-05-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: rack-test
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: 3.0.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
-description: You should use protection!
-email:
-- konstantin.mailinglists@googlemail.com
-- p0deje@gmail.com
-- self@hecticjeff.net
-- coreyward@me.com
-- dek-oss@gravitext.com
-- homakov@gmail.com
-- florian.gilcher@asquera.de
-- developer@fojasaur.us
-- mael@clerambault.fr
-- martin.mauch@gmail.com
-- kaz.july.7@gmail.com
-- s.savulchik@gmail.com
-- steve.agalloco@gmail.com
-- akzhan.abdulin@gmail.com
-- toby.net.info.mail+git@gmail.com
-- bjoerge@bengler.no
-- cheald@gmail.com
+        version: 3.0.0
+description: Protect against typical web attacks, works with all Rack apps, including
+  Rails.
+email: sinatrarb@googlegroups.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- Gemfile
 - License
 - README.md
 - Rakefile
@@ -105,6 +67,8 @@ files:
 - lib/rack/protection.rb
 - lib/rack/protection/authenticity_token.rb
 - lib/rack/protection/base.rb
+- lib/rack/protection/content_security_policy.rb
+- lib/rack/protection/cookie_tossing.rb
 - lib/rack/protection/escaped_params.rb
 - lib/rack/protection/form_token.rb
 - lib/rack/protection/frame_options.rb
@@ -115,46 +79,33 @@ files:
 - lib/rack/protection/remote_referrer.rb
 - lib/rack/protection/remote_token.rb
 - lib/rack/protection/session_hijacking.rb
+- lib/rack/protection/strict_transport.rb
 - lib/rack/protection/version.rb
 - lib/rack/protection/xss_header.rb
 - rack-protection.gemspec
-- spec/authenticity_token_spec.rb
-- spec/escaped_params_spec.rb
-- spec/form_token_spec.rb
-- spec/frame_options_spec.rb
-- spec/http_origin_spec.rb
-- spec/ip_spoofing_spec.rb
-- spec/json_csrf_spec.rb
-- spec/path_traversal_spec.rb
-- spec/protection_spec.rb
-- spec/remote_referrer_spec.rb
-- spec/remote_token_spec.rb
-- spec/session_hijacking_spec.rb
-- spec/spec_helper.rb
-- spec/xss_header_spec.rb
-homepage: http://github.com/rkh/rack-protection
-licenses: []
+homepage: http://github.com/sinatra/sinatra/tree/master/rack-protection
+licenses:
+- MIT
+metadata: {}
 post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
-  none: false
   requirements:
-  - - ! '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
-  none: false
   requirements:
-  - - ! '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 1.8.23
+rubygems_version: 2.6.11
 signing_key: 
-specification_version: 3
-summary: You should use protection!
+specification_version: 4
+summary: Protect against typical web attacks, works with all Rack apps, including
+  Rails.
 test_files: []
-has_rdoc: 

data/spec/authenticity_token_spec.rb

@@ -1,33 +0,0 @@
-require File.expand_path('../spec_helper.rb', __FILE__)
-
-describe Rack::Protection::AuthenticityToken do
-  it_behaves_like "any rack application"
-
-  it "denies post requests without any token" do
-    post('/').should_not be_ok
-  end
-
-  it "accepts post requests with correct X-CSRF-Token header" do
-    post('/', {}, 'rack.session' => {:csrf => "a"}, 'HTTP_X_CSRF_TOKEN' => "a")
-    last_response.should be_ok
-  end
-
-  it "denies post requests with wrong X-CSRF-Token header" do
-    post('/', {}, 'rack.session' => {:csrf => "a"}, 'HTTP_X_CSRF_TOKEN' => "b")
-    last_response.should_not be_ok
-  end
-
-  it "accepts post form requests with correct authenticity_token field" do
-    post('/', {"authenticity_token" => "a"}, 'rack.session' => {:csrf => "a"})
-    last_response.should be_ok
-  end
-
-  it "denies post form requests with wrong authenticity_token field" do
-    post('/', {"authenticity_token" => "a"}, 'rack.session' => {:csrf => "b"})
-    last_response.should_not be_ok
-  end
-
-  it "prevents ajax requests without a valid token" do
-    post('/', {}, "HTTP_X_REQUESTED_WITH" => "XMLHttpRequest").should_not be_ok
-  end
-end

data/spec/escaped_params_spec.rb

@@ -1,44 +0,0 @@
-require File.expand_path('../spec_helper.rb', __FILE__)
-
-describe Rack::Protection::EscapedParams do
-  it_behaves_like "any rack application"
-
-  context 'escaping' do
-    it 'escapes html entities' do
-      mock_app do |env|
-        request = Rack::Request.new(env)
-        [200, {'Content-Type' => 'text/plain'}, [request.params['foo']]]
-      end
-      get '/', :foo => "<bar>"
-      body.should == '&lt;bar&gt;'
-    end
-
-    it 'leaves normal params untouched' do
-      mock_app do |env|
-        request = Rack::Request.new(env)
-        [200, {'Content-Type' => 'text/plain'}, [request.params['foo']]]
-      end
-      get '/', :foo => "bar"
-      body.should == 'bar'
-    end
-
-    it 'copes with nested arrays' do
-      mock_app do |env|
-        request = Rack::Request.new(env)
-        [200, {'Content-Type' => 'text/plain'}, [request.params['foo']['bar']]]
-      end
-      get '/', :foo => {:bar => "<bar>"}
-      body.should == '&lt;bar&gt;'
-    end
-
-    it 'leaves cache-breaker params untouched' do
-      mock_app do |env|
-        request = Rack::Request.new(env)
-        [200, {'Content-Type' => 'text/plain'}, ['hi']]
-      end
-
-      get '/?95df8d9bf5237ad08df3115ee74dcb10'
-      body.should == 'hi'
-    end
-  end
-end

data/spec/form_token_spec.rb

@@ -1,33 +0,0 @@
-require File.expand_path('../spec_helper.rb', __FILE__)
-
-describe Rack::Protection::FormToken do
-  it_behaves_like "any rack application"
-
-  it "denies post requests without any token" do
-    post('/').should_not be_ok
-  end
-
-  it "accepts post requests with correct X-CSRF-Token header" do
-    post('/', {}, 'rack.session' => {:csrf => "a"}, 'HTTP_X_CSRF_TOKEN' => "a")
-    last_response.should be_ok
-  end
-
-  it "denies post requests with wrong X-CSRF-Token header" do
-    post('/', {}, 'rack.session' => {:csrf => "a"}, 'HTTP_X_CSRF_TOKEN' => "b")
-    last_response.should_not be_ok
-  end
-
-  it "accepts post form requests with correct authenticity_token field" do
-    post('/', {"authenticity_token" => "a"}, 'rack.session' => {:csrf => "a"})
-    last_response.should be_ok
-  end
-
-  it "denies post form requests with wrong authenticity_token field" do
-    post('/', {"authenticity_token" => "a"}, 'rack.session' => {:csrf => "b"})
-    last_response.should_not be_ok
-  end
-
-  it "accepts ajax requests without a valid token" do
-    post('/', {}, "HTTP_X_REQUESTED_WITH" => "XMLHttpRequest").should be_ok
-  end
-end

data/spec/frame_options_spec.rb

@@ -1,39 +0,0 @@
-require File.expand_path('../spec_helper.rb', __FILE__)
-
-describe Rack::Protection::FrameOptions do
-  it_behaves_like "any rack application"
-
-  it 'should set the X-Frame-Options' do
-    get('/', {}, 'wants' => 'text/html').headers["X-Frame-Options"].should == "SAMEORIGIN"
-  end
-
-  it 'should not set the X-Frame-Options for other content types' do
-    get('/', {}, 'wants' => 'text/foo').headers["X-Frame-Options"].should be_nil
-  end
-
-  it 'should allow changing the protection mode' do
-    # I have no clue what other modes are available
-    mock_app do
-      use Rack::Protection::FrameOptions, :frame_options => :deny
-      run DummyApp
-    end
-
-    get('/', {}, 'wants' => 'text/html').headers["X-Frame-Options"].should == "DENY"
-  end
-
-
-  it 'should allow changing the protection mode to a string' do
-    # I have no clue what other modes are available
-    mock_app do
-      use Rack::Protection::FrameOptions, :frame_options => "ALLOW-FROM foo"
-      run DummyApp
-    end
-
-    get('/', {}, 'wants' => 'text/html').headers["X-Frame-Options"].should == "ALLOW-FROM foo"
-  end
-
-  it 'should not override the header if already set' do
-    mock_app with_headers("X-Frame-Options" => "allow")
-    get('/', {}, 'wants' => 'text/html').headers["X-Frame-Options"].should == "allow"
-  end
-end

data/spec/http_origin_spec.rb

@@ -1,38 +0,0 @@
-require File.expand_path('../spec_helper.rb', __FILE__)
-
-describe Rack::Protection::HttpOrigin do
-  it_behaves_like "any rack application"
-
-  before(:each) do
-    mock_app do
-      use Rack::Protection::HttpOrigin
-      run DummyApp
-    end
-  end
-
-  %w(GET HEAD POST PUT DELETE).each do |method|
-    it "accepts #{method} requests with no Origin" do
-      send(method.downcase, '/').should be_ok
-    end
-  end
-
-  %w(GET HEAD).each do |method|
-    it "accepts #{method} requests with non-whitelisted Origin" do
-      send(method.downcase, '/', {}, 'HTTP_ORIGIN' => 'http://malicious.com').should be_ok
-    end
-  end
-
-  %w(POST PUT DELETE).each do |method|
-    it "denies #{method} requests with non-whitelisted Origin" do
-      send(method.downcase, '/', {}, 'HTTP_ORIGIN' => 'http://malicious.com').should_not be_ok
-    end
-
-    it "accepts #{method} requests with whitelisted Origin" do
-      mock_app do
-        use Rack::Protection::HttpOrigin, :origin_whitelist => ['http://www.friend.com']
-        run DummyApp
-      end
-      send(method.downcase, '/', {}, 'HTTP_ORIGIN' => 'http://www.friend.com').should be_ok
-    end
-  end
-end

data/spec/ip_spoofing_spec.rb

@@ -1,35 +0,0 @@
-require File.expand_path('../spec_helper.rb', __FILE__)
-
-describe Rack::Protection::IPSpoofing do
-  it_behaves_like "any rack application"
-
-  it 'accepts requests without X-Forward-For header' do
-    get('/', {}, 'HTTP_CLIENT_IP' => '1.2.3.4', 'HTTP_X_REAL_IP' => '4.3.2.1')
-    last_response.should be_ok
-  end
-
-  it 'accepts requests with proper X-Forward-For header' do
-    get('/', {}, 'HTTP_CLIENT_IP' => '1.2.3.4',
-      'HTTP_X_FORWARDED_FOR' => '192.168.1.20, 1.2.3.4, 127.0.0.1')
-    last_response.should be_ok
-  end
-
-  it 'denies requests where the client spoofs X-Forward-For but not the IP' do
-    get('/', {}, 'HTTP_CLIENT_IP' => '1.2.3.4', 'HTTP_X_FORWARDED_FOR' => '1.2.3.5')
-    last_response.should_not be_ok
-  end
-
-  it 'denies requests where the client spoofs the IP but not X-Forward-For' do
-    get('/', {}, 'HTTP_CLIENT_IP' => '1.2.3.5',
-      'HTTP_X_FORWARDED_FOR' => '192.168.1.20, 1.2.3.4, 127.0.0.1')
-    last_response.should_not be_ok
-  end
-
-  it 'denies requests where IP and X-Forward-For are spoofed but not X-Real-IP' do
-    get('/', {},
-      'HTTP_CLIENT_IP'       => '1.2.3.5',
-      'HTTP_X_FORWARDED_FOR' => '1.2.3.5',
-      'HTTP_X_REAL_IP'       => '1.2.3.4')
-    last_response.should_not be_ok
-  end
-end