rack-session-smart_cookie 0.1.4 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: e83bdebac8d1746d4918c878dfa16fdfcd8f4b03
-  data.tar.gz: 77739204186ab0b9d50c0b15abca508d326cb990
+SHA256:
+  metadata.gz: e5ffffe8cd308cab83819695f464b794182ff28f8c8abf8321d8914b2139eb54
+  data.tar.gz: 7090e3b03755ed1d151ffa726c843a77956c2b5cf37aa0635efed714252418e5
 SHA512:
-  metadata.gz: 4b026b789349a4e07d5da56fb01ae3012f62ff91b0cea6b87e7fdb89589638f5721cc1bbb9b0b88a4443ed351541785fe1f92cb74c95f3d64a143b22e5baa60e
-  data.tar.gz: 1642c2bf3230c4b6f0e0ad0e52dccc7a2073f11982d1019b9b1ee3dddf9d6dc42e1146f7591820fbdca7876d12a5e072a7382a3e2140a96e771ab033053ed00e
+  metadata.gz: 431867d1ebd8cde589311165c7f66840e2db71d847548b29ab94032a5b30f476b87b884fd2c452c2d3b05e61831ce0826335e14da7245cf8c900cb3b536278b0
+  data.tar.gz: efa109695b73584d769ebb74b357db722d8e36fc0b19ea1f16b550bb87574ffa13ae61626a103124515a5851b481c8b56619e95741db10d2dde62e8ae3118376

data/Gemfile

@@ -3,5 +3,3 @@ source 'https://rubygems.org'
 git_source(:github) { |repo_name| "https://github.com/#{repo_name}" }
 
 gemspec
-
-gem 'openssl', '>= 2.0.3'

data/README.md

@@ -94,6 +94,17 @@ use Rack::Session::SmartCookie, :coder=>my_coder
 
 Please see the [MessagePack][3] documentation for more details.
 
+Rack::Session::SmartCookie also accepts `:digest` and `:digest_bytes` options
+that allow you to choose the message digest algorithm and limit the size of the
+generated digest. This lets you e.g. truncate 64-byte HMAC-SHA512 digests down
+to 32 bytes (i.e. HMAC-SHA512/256):
+
+```
+use Rack::Session::SmartCookie, :digest=>'SHA512', :digest_bytes=>32
+```
+
+The `:hmac` option overrides the `:digest` option.
+
 ## Comparisons
 
 For general size and performance benchmarks of the encoding schemes, see

data/lib/rack/session/smart_cookie.rb

@@ -70,12 +70,14 @@ module Rack
 
       def initialize(app, options={})
         options[:coder] ||= MessagePack.new
-        options[:hmac] = OpenSSL::Digest(DEFAULT_DIGEST) unless options.key?(:hmac)
+        unless options.key?(:hmac)
+          options[:hmac] = OpenSSL::Digest(options.fetch(:digest, DEFAULT_DIGEST))
+        end
 
         super
 
         if @secrets.any?
-          hmac = options[:hmac].new
+          hmac = options[:hmac].new # throwaway object for inspection purposes
 
           warn <<-MSG if BAD_DIGESTS.include?(hmac.name)
         SECURITY WARNING: You have elected to use an old and insecure message
@@ -90,7 +92,7 @@ module Rack
         Called from: #{caller[0]}.
           MSG
 
-          unless (SECRET_MIN_BYTESIZE..hmac.block_length).cover?(@secrets.first.bytesize)
+          unless (SECRET_MIN_BYTESIZE .. hmac.block_length).cover?(@secrets.first.bytesize)
             show_caveat = hmac.digest_length > SECRET_MIN_BYTESIZE
 
             message = String.new(<<-MSG)
@@ -112,6 +114,8 @@ module Rack
             warn message
           end
         end
+
+        @digest_bytes = options[:digest_bytes]
       end
 
       private
@@ -149,7 +153,8 @@ module Rack
       end
 
       def generate_hmac(data, secret)
-        Base64.encode(OpenSSL::HMAC.digest(@hmac.new, secret, data))
+        digest = OpenSSL::HMAC.digest(@hmac.new, secret, data)
+        Base64.encode(@digest_bytes ? digest.byteslice(0, @digest_bytes) : digest)
       end
     end
   end

data/lib/rack/session/smart_cookie/version.rb

@@ -10,7 +10,7 @@ module Rack
     Cookie = Class.new unless defined?(Cookie)
 
     class SmartCookie < Cookie
-      VERSION = '0.1.4'.freeze
+      VERSION = '0.2.0'.freeze
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack-session-smart_cookie
 version: !ruby/object:Gem::Version
-  version: 0.1.4
+  version: 0.2.0
 platform: ruby
 authors:
 - Mike Pastore
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2017-11-02 00:00:00.000000000 Z
+date: 2018-09-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: msgpack
@@ -147,7 +147,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.13
+rubygems_version: 2.7.6
 signing_key: 
 specification_version: 4
 summary: Slightly smarter session cookies for Rack 2 apps