rack-ssl-enforcer 0.1.9 → 0.2.0

data/README.rdoc

@@ -1,6 +1,7 @@
-= rack-ssl-enforcer
+= Rack::SslEnforcer
 
-Rack::SslEnforcer is a simple Rack middleware to enforce ssl connections
+Rack::SslEnforcer is a simple Rack middleware to enforce ssl connections. As of Version 0.2.0, Rack::SslEnforcer marks
+Cookies as secure and enables HSTS by default.
 
 
 == Installation
@@ -29,11 +30,15 @@ And force http for non-https path
 
   use Rack::SslEnforcer, :only => ["/login", /\.xml$/], :strict => true
 
+To set HSTS expiry and subdomain inclusion (defaults: one year, true)
+
+	use Rack::SslEnforcer, :hsts => {:expires => 500, :subdomains => false}
+
 
 == TODO
 
-* Add HSTS support, see http://en.wikipedia.org/wiki/Strict_Transport_Security
 * Add configuration option to specify local http / https ports
+* Cleanup tests
 
 
 == Contributors
@@ -56,7 +61,8 @@ Flagging cookies as secure functionality is greatly inspired by {Joshua Peek's R
 * Add tests for it. This is important so I don't break it in a
   future version unintentionally.
 * Commit, do not mess with rakefile, version, or history.
-  (if you want to have your own version, that is fine but bump version in a commit by itself I can ignore when I pull)
+  (if you want to have your own version, 
+  that is fine but bump version in a commit by itself I can ignore when I pull)
 * Send me a pull request. Bonus points for topic branches.
 
 

data/lib/rack/ssl-enforcer.rb

@@ -20,12 +20,14 @@ module Rack
       elsif ssl_request?(env)
         status, headers, body = @app.call(env)
         flag_cookies_as_secure!(headers)
+        set_hsts_headers!(headers)
         [status, headers, body]
       else
         @app.call(env)
       end
     end
     
+    
   private
     
     def ssl_request?(env)
@@ -69,6 +71,7 @@ module Rack
       scheme == 'https' ? 443 : 80
     end
 
+    # see http://en.wikipedia.org/wiki/HTTP_cookie#Cookie_hijacking
     def flag_cookies_as_secure!(headers)
       if cookies = headers['Set-Cookie']
         headers['Set-Cookie'] = cookies.split("\n").map { |cookie|
@@ -81,5 +84,13 @@ module Rack
       end
     end
     
+    # see http://en.wikipedia.org/wiki/Strict_Transport_Security
+    def set_hsts_headers!(headers)
+      opts = { :expires => 31536000, :subdomains => true }.merge(@options[:hsts] || {})
+      value  = "max-age=#{opts[:expires]}"
+      value += "; includeSubDomains" if opts[:subdomains]
+      headers.merge!({ 'Strict-Transport-Security' => value })
+    end
+    
   end
 end

data/lib/rack/ssl-enforcer/version.rb

@@ -1,5 +1,5 @@
 module Rack
   class SslEnforcer
-    VERSION = "0.1.9"
+    VERSION = "0.2.0"
   end
 end

metadata

@@ -4,9 +4,9 @@ version: !ruby/object:Gem::Version
   prerelease: false
   segments: 
   - 0
-  - 1
-  - 9
-  version: 0.1.9
+  - 2
+  - 0
+  version: 0.2.0
 platform: ruby
 authors: 
 - Tobias Matthies