rack-request_replication 0.0.3 → 0.0.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: f066360d1270ffe1fd8bf8c0f6045c40884e7c4b
-  data.tar.gz: 3cb0501284af15b165271922a71627b418873907
+  metadata.gz: f6ae7943af00005747ede7913cb2a8ec935ac80e
+  data.tar.gz: 469f4eda7bd661a49dd74ac05f57a7085c0e871e
 SHA512:
-  metadata.gz: d38e8f9f3e53f44c2df81d9ee16b9e8459e54b8a8c454ef5c9abe2e2dbd5c8276dbcaecca6342d10421c616c942ce7e16f27bda9f03995223f5671c41d8c85ef
-  data.tar.gz: aad6649afb76b4b38beab7586e24fedf87640d66a98b35e98ad4b42e4b45d34c427b84064ace3f839a95088dd39400f0c1b8e03ca601a5e6fd014732169f6c5c
+  metadata.gz: 513b0e735a59e0acade09e128779bd4a132613e809fb7a1d5db9decb2d51f0e964b70776e05489dc77d24a20a004c4252a56dda915107e002c9a91f2f64d0f87
+  data.tar.gz: 467c2ba93881da20eea3d9567eb21039b59f87d3eacb409c27fc0ad86b8c1af014644ac12a4bec00282d9b6d026d1b44bdade62a08f4ad3f077e04ce32c08c0f

data/README.md

@@ -1,17 +1,62 @@
 # Rack::RequestReplication - Replicate Rack app HTTP requests
 
 Replicate requests from one app instance to another. At
-[Springest](http://www.springest.com) we use this to test new features.
-We replicate all live requests to our staging environment to test new
-code before it goes live. With real traffic!
+[Springest](http://www.springest.com) we used
+[Gor](https://github.com/buger/gor) once to test our new Postgres stack
+vs our at that time current MySQL stack.
+We replicated all live requests to our staging environment to test new
+code before it went live. With real traffic!
 
-## Session support
+Unfortunately, we could not test everything we wanted with the
+[setup with Gor](http://devblog.springest.com/testing-big-infrastructure-changes-at-springest/).
+Stuff that relied on sessions (like
+[MySpringest](https://www.springest.com/my-springest), and course
+management through our [Admin panel](http://providers.springest.com/))
+could not be tested properly because the staging environment did not
+share sessions with the production stack.
+
+Recently, @foxycoder was asked to give a talk about these adventures at
+[Amsterdam.rb](http://www.meetup.com/Amsterdam-rb/events/206133762/).
+And while we were thinking about all the stuff that we needed to do to
+get it right with Gor, we came up with the concept of this gem.
+
+## Full control over the requests through Rack
+
+This is Rack MiddleWare. And thanks to that, we have all the information
+and handy tools available to parse and alter request data before we
+forward it to another stack.
+
+
+## Features
+
+At the moment, it just forwards the request with only a couple of
+changes:
+
+- The host and/or port to match the stack to forward to.
+- The session cookie – it stores a persistent link between the source
+  app's session and the destination app's session in Redis.
+- The CSRF token – same as the session, the destination app's
+  `authenticity_token` is persistent and used in consecutive requests.
+
+### Session support
 
 It has support for sessions. To make use of it, you need to have Redis
 running. Redis serves as a key-value store where sessions from the
 Source App are linked to sessions from the Forward App. This way both
 apps can have their own session management.
 
+### Rails's CSRF tokens
+
+Rails uses a cross site scripting defense mechanism in the form of an
+`authenticity_token` parameter. Absense of it, or modifying it between
+requests results in XSS errors. Therefore we needed to make sure these
+were properly captured and replaced by the Forwarder before sending the
+request to the other application.
+
+CSRF tokens are also persisted in Redis and used in consecutive requests, by
+updating `params["authenticity_token"]` before handing off the request
+to the replica app.
+
 ## API Docs
 
 Check out the official [API docs](http://rubydoc.info/gems/rack-request_replication)

data/lib/rack/request_replication.rb

@@ -1,3 +1,2 @@
 require "rack/request_replication/version"
-require "rack/request_replication/logger"
 require "rack/request_replication/forwarder"

data/lib/rack/request_replication/forwarder.rb

@@ -67,13 +67,68 @@ module Rack
         Thread.new do
           begin
             forward_request.add_field("Cookie", cookies( request ))
-            update_cookies( request, http.request(forward_request) )
+            update_csrf_token_and_cookies( request, http.request(forward_request) )
           rescue => e
             logger.debug "Replicating request failed with: #{e.message}"
           end
         end
       end
 
+      ##
+      # Update CSRF token and cookies.
+      #
+      # @param   [Rack::Request] request
+      # @param   [Net::HTTP::Response] response
+      #
+      def update_csrf_token_and_cookies( request, response )
+        update_csrf_token( request, response )
+        update_cookies( request, response )
+      end
+
+      ##
+      # The CSRF-token to use.
+      #
+      # @param   [Rack::Request] request
+      # @returns [String]
+      #
+      def csrf_token( request )
+        token = request.params["authenticity_token"]
+        return if token.nil?
+
+        redis.get( "csrf-#{token}" ) || token
+      end
+
+      ##
+      # Update CSRF token to bypass XSS errors in Rails.
+      #
+      # @param   [Rack::Request] request
+      #
+      def update_csrf_token( request, response )
+        token = request.params["authenticity_token"]
+        return if token.nil?
+
+        response_token = csrf_token_from response
+        return token if response_token.nil?
+
+        redis.set "csrf-#{token}", response_token
+      end
+
+      ##
+      # Pull CSRF token from the HTML document's header.
+      #
+      # @param   [Net::HTTP::Response] response
+      # @returns [String]
+      #
+      def csrf_token_from( response )
+        response.split("\n").
+          select{|l| l.match(/csrf-token/) }.
+          first.split(" ").
+          select{|t| t.match(/^content=/)}.first.
+          match(/content="(.*)"/)[1]
+      rescue
+        nil
+      end
+
       ##
       # Update cookies from the forwarded request using the session id
       # from the cookie of the source app as a key. The cookie is stored
@@ -234,6 +289,11 @@ module Rack
           value = request.send( m )
           replicated_options[m] = value unless value.nil?
         end
+
+        if replicated_options[:params]["authenticity_token"]
+          replicated_options[:params]["authenticity_token"] = csrf_token
+        end
+
         replicated_options
       end
 

data/lib/rack/request_replication/version.rb

@@ -1,5 +1,5 @@
 module Rack
   module RequestReplication
-    VERSION = "0.0.3"
+    VERSION = "0.0.5"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack-request_replication
 version: !ruby/object:Gem::Version
-  version: 0.0.3
+  version: 0.0.5
 platform: ruby
 authors:
 - Wouter de Vos
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-09-15 00:00:00.000000000 Z
+date: 2014-09-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler