rack-secure_only 0.2.0 → 0.3.0

data/README.rdoc

@@ -5,9 +5,10 @@ SecureOnly will redirect to https if the request is on http.
 When passed :secure => false it will do the opposite and redirect https to http.
 
 The check if the current request is on https includes checking the HTTP_X_FORWARDED_PROTO header.
-
 This means the redirect will also work on heroku.com
 
+This can be disabled by setting the :use_http_x_forwarded_proto option to false.
+
 == Installation
 
 	sudo gem install rack-secure_only
@@ -26,6 +27,16 @@ This means the redirect will also work on heroku.com
 	    use Rack::SecureOnly, :secure => false
 	    run lambda { |env| [200, { 'Content-Type' => 'text/plain' }, ["NON SECURE APP"]] }
 	  end
+	
+	  map '/secure_without_http_x_forwarded_proto_check' do
+	    use Rack::SecureOnly, :use_http_x_forwarded_proto => false
+	    run lambda { |env| [200, { 'Content-Type' => 'text/plain' }, ["SECURE APP"]] }
+	  end
+	
+	  map '/secure_with_fixed_redirect_ulr' do
+	    use Rack::SecureOnly, :redirect_to => "https://my.site.org/login"
+	    run lambda { |env| [200, { 'Content-Type' => 'text/plain' }, ["SECURE APP"]] }
+	  end
 	end
 	
 	run app

data/VERSION

@@ -1 +1 @@
-0.2.0
+0.3.0

data/lib/rack/secure_only.rb

@@ -11,12 +11,21 @@ module Rack
   #
   # This means the redirect will also work on heroku.com
   #
+  # @param [Hash] opts options for redirect rules
+  # @option opts [Boolean] :secure If set to false will redirect https to http, defaults to true
+  # @option opts [Fixnum] :status_code Status code to redirect with, defaults to 301
+  # @option opts [Boolean] :use_http_x_forwarded_proto When set to false will not check for HTTP_X_FORWARDED_PROTO header
+  # @option opts [String] :redirect_to When set will use the provided url to redirect to
+  #
   class SecureOnly
     def initialize(app, opts={})
-      opts    = { :secure => true }.merge(opts)
+      opts    = { :secure => true, :status_code => 301, :redirect_to => nil, :use_http_x_forwarded_proto => true }.merge(opts)
       @app    = app
-      @secure = opts[:secure]
-      @redirect_status_code = 301
+      
+      @secure               = opts[:secure]
+      @redirect_status_code = opts[:status_code]
+      @redirect_to          = opts[:redirect_to]
+      @use_http_x_forward  = !!opts[:use_http_x_forwarded_proto]
     end
     
     def call(env)
@@ -29,14 +38,14 @@ module Rack
     # and the HTTP_X_FORWARDED_PROTO header is not set to https
     # 
     def on_http?(env)
-      ( env['rack.url_scheme'] == 'http' && env['HTTP_X_FORWARDED_PROTO'] != 'https')
+      ( env['rack.url_scheme'] == 'http' && ( use_x_forward? ? env['HTTP_X_FORWARDED_PROTO'] != 'https' : true ) )
     end
     
     # Returns true if the current url scheme is https or 
     # the HTTP_X_FORWARDED_PROTO header is set to https
     # 
     def on_https?(env)
-      ( env['rack.url_scheme'] == 'https' || env['HTTP_X_FORWARDED_PROTO'] == 'https')
+      ( env['rack.url_scheme'] == 'https' || ( use_x_forward? ? env['HTTP_X_FORWARDED_PROTO'] == 'https' : false ) )
     end
     
     # Boolean accesor for :secure
@@ -55,13 +64,18 @@ module Rack
     
     def redirect?(env)
       req = Request.new(env)
+      url = @redirect_to || req.url
       if secure? && on_http?(env)
-        return [true, req.url.gsub(/^http:/,'https:')]
+        return [true, url.gsub(/^http:/,'https:')]
       elsif not_secure? && on_https?(env)
-        return [true, req.url.gsub(/^https:/,'http:')]
+        return [true, url.gsub(/^https:/,'http:')]
       else
         return [false, req.url]
       end
     end
+    
+    def use_x_forward?
+      @use_http_x_forward
+    end
   end
 end

data/rack-secure_only.gemspec

@@ -5,7 +5,7 @@
 
 Gem::Specification.new do |s|
   s.name = %q{rack-secure_only}
-  s.version = "0.2.0"
+  s.version = "0.3.0"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Klaas Speller"]

data/spec/rack/secure_only_spec.rb

@@ -142,4 +142,50 @@ describe Rack::SecureOnly do
       end
     end
   end
+  
+  describe "configuration" do
+    it "should use :status_code if provided" do
+      app = Rack::Builder.new do      
+        use Rack::SecureOnly, :status_code => 307
+        run lambda { |env| [200, { 'Content-Type' => 'text/plain' }, ["SECURE APP"]] }
+      end
+      @request  = Rack::MockRequest.new(app)
+      @response = @request.get('http://www.example.com/')
+      
+      @response.status.should == 307
+    end
+    
+    it "should use :redirect_to if provided" do
+      app = Rack::Builder.new do      
+        use Rack::SecureOnly, :redirect_to => 'https://www.example.com/login'
+        run lambda { |env| [200, { 'Content-Type' => 'text/plain' }, ["SECURE APP"]] }
+      end
+      @request  = Rack::MockRequest.new(app)
+      @response = @request.get('http://www.example.com/')
+      
+      @response.location.should == 'https://www.example.com/login'
+    end
+    
+    it "should use :redirect_to if provided with :secure => false" do
+      app = Rack::Builder.new do      
+        use Rack::SecureOnly, :redirect_to => 'https://www.example.com/login', :secure => false
+        run lambda { |env| [200, { 'Content-Type' => 'text/plain' }, ["SECURE APP"]] }
+      end
+      @request  = Rack::MockRequest.new(app)
+      @response = @request.get('https://www.example.com/')
+      
+      @response.location.should == 'http://www.example.com/login'
+    end
+    
+    it "should not check HTTP_X_FORWARDED_PROTO if :use_http_x_forwarded_proto is set to false" do
+      app = Rack::Builder.new do      
+        use Rack::SecureOnly, :use_http_x_forwarded_proto => false
+        run lambda { |env| [200, { 'Content-Type' => 'text/plain' }, ["SECURE APP"]] }
+      end
+      @request  = Rack::MockRequest.new(app)
+      @response = @request.get('http://www.example.com/',  { 'HTTP_X_FORWARDED_PROTO' => 'https' })
+      
+      @response.location.should == "https://www.example.com/"      
+    end
+  end
 end

metadata

@@ -4,9 +4,9 @@ version: !ruby/object:Gem::Version
   prerelease: false
   segments: 
   - 0
-  - 2
+  - 3
   - 0
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors: 
 - Klaas Speller