rack-steady_etag 0.3.1 → 0.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7d2e8f19f09cac1377380b52aaac1c09e39bb565af7976863cab2c0f6ec303fe
-  data.tar.gz: 84aeee379982cce1a96fc25600b60a4b4bd01ab4a3699792ce821a57bf70ca31
+  metadata.gz: bcfda15fd495c39d8c54909f7c634bc117180278a69d1d5950009c5e50b65f66
+  data.tar.gz: 77fc5f0e7e53af4dd3f30aaa9617775f636e38b340a3cd0789dfbc1db3473a1f
 SHA512:
-  metadata.gz: 0d16e5141ab9794dcf6cf751ac150aaec48e058fd9acce6ae4ea11011ac3d79a9a65ff0d07abfbe8d9df797f6677cf2688613094975a67a78fe726b86c9a66b1
-  data.tar.gz: 508c64a1acc11988a64d498d05c26d707e6eee0626d0d656bc05823e8c63c30775056325874f1bff4c87b1335a44c054e05f40db8e7aa3abd7e258663abc3d30
+  metadata.gz: 769df0e0d8ef0f037f4c176b83f6639a08fce011c18bcc6d718fb5b2b56040be2512c751fb77b17c4d9da65ceae8f72d785a3a4cc4fa0b3b670824dbf9666223
+  data.tar.gz: 8af6b7f73d97c396e6acbdc505a28fe0519f765684aad151d19cef2e1b0d79c2e364fb929a153a58d07d364d2b4bb23df677214f074f3e1fa971f787e2d6f69e

data/CHANGELOG.md

@@ -2,9 +2,12 @@ All notable changes to this project will be documented in this file.
 
 This project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
-
 ## Unreleased
 
+## 0.3.2 - 2022-07-29
+
+- Digest includes the [unmasked Rails CSRF token](https://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection.html#method-i-real_csrf_token) in case a Rails controller manually rotates the token.  
+
 ## 0.3.1 - 2022-07-19
 
 - Fix a bug where we would not strip HTML responses with an embedded charset (e.g. `text/html; charset=utf-8`).

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    rack-steady_etag (0.3.1)
+    rack-steady_etag (0.3.2)
       rack (>= 1.4.7, < 3)
 
 GEM

data/README.md

@@ -1,6 +1,6 @@
 # Rack::SteadyETag
 
-`Rack::SteadyETag` is a Rack middleware that generates the same default [`ETag`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ETag) for responses that only differ in CSRF tokens or CSP nonces.
+`Rack::SteadyETag` is a Rack middleware that generates the same default [`ETag`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ETag) for responses that only differ in XOR-masked CSRF tokens or CSP nonces.
 
 By default Rails uses [`Rack::ETag`](https://rdoc.info/github/rack/rack/Rack/ETag) to generate `ETag` headers by hashing the response body. In theory this would [enable caching](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-None-Match) for multiple requests to the same resource. However, since most Rails application layouts insert randomly rotating CSRF tokens and CSP nonces into the HTML, two requests for the same content and user will never produce the same response bytes. This means `Rack::ETag` will never send the same ETag twice, causing responses to [never hit a cache](https://github.com/rails/rails/issues/29889).
 
@@ -46,6 +46,7 @@ This middleware can also add a default `Cache-Control` header for responses it *
 ## Covered edge cases
 
 - Different `ETags` are generated when the same content is accessed with different Rack sessions.
+- Different `ETags` are generated when a Rails controller manually rotates the CSRF token.
 - `ETags` are only generated when the response is `Cache-Control: private` (this is a default in Rails).
 - No `ETag` is generated when the response already has an `ETag` header.
 - No `ETag` is generated when the response already has an `Last-Modified` header.

data/lib/rack/steady_etag/version.rb

@@ -2,6 +2,6 @@
 
 module Rack
   class SteadyEtag
-    VERSION = "0.3.1"
+    VERSION = "0.3.2"
   end
 end

data/lib/rack/steady_etag.rb

@@ -135,8 +135,17 @@ module Rack
     def initialize_digest(session)
       digest = Digest::SHA256.new
 
-      if session && (session_id = session['session_id'])
-        digest << session_id.to_s
+      if session
+        if (session_id = session['session_id'])
+          digest << session_id.to_s
+        end
+
+        # When we sign in or out with Devise, we always get a new session ID
+        # and CSRF token. Lets anyway include the real (unmasked) CSRF token in the
+        # digest in case a Rails controller manually rotates the token.
+        if (rails_csrf_token = session['_csrf_token'])
+          digest << rails_csrf_token.to_s
+        end
       end
 
       digest

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack-steady_etag
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.3.2
 platform: ruby
 authors:
 - Henning Koch
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-07-19 00:00:00.000000000 Z
+date: 2022-07-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack