rack-u2f 0.1.1 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 75385507e44ffd51443e6d4a864251a72cbf9724
-  data.tar.gz: 3d20699e67ed4f01aa90177111d1b8dddd786a9a
+  metadata.gz: 39c69e83247c51be9d502293e7e83157b0995713
+  data.tar.gz: 146f77e789e30cdeecae8662ef149298e9a7c568
 SHA512:
-  metadata.gz: df5d4356775a6eb09cd2ed8a816a74359bbd666b111575a587e56f47a059c0ae9712ef4c6389afed2222c1748186110647c5a575a694743e4dcd5b1529814a2e
-  data.tar.gz: f3e91e2bee2371b14c40eb1a7ed4ef15847d004603bc9f51938d4e0796b13baeb2ef2233166705d205c0efc0d53c34afc8e393b8001821799f00a7032b2c34c7
+  metadata.gz: b197fa625b8852b8f735bcf5df26344011e1ff7412962dbbbc39c5a9daa832c7624d665e6b2f70e4451e11b97e9eaa57858be78f2332f26c787df41488009038
+  data.tar.gz: 22fd071a1fd8971aeb34dcf4e0736a2ec91714aadb2ecc7b048b365249a3958a9167ef422c9a64ac3e4329c2a1253e2e776a26bb52839fe05b4f396d0cf8f6e0

data/.gitignore

@@ -7,6 +7,6 @@
 /pkg/
 /spec/reports/
 /tmp/
-
+*.gem
 # rspec failure tracking
 .rspec_status

data/README.md

@@ -1,8 +1,13 @@
 # Rack::U2f
 
+Rack middleware to require add u2f authentication.
+
 Note: This gem needs a tidy up and will be properly released by end of Nov 2017
 
 [![Gem Version](https://badge.fury.io/rb/rack-u2f.svg)](https://badge.fury.io/rb/rack-u2f)
+[![Build Status](https://api.travis-ci.org/eadz/rack-u2f.svg?branch=master)](https://travis-ci.org/eadz/rack-u2f)
+
+Note: U2F only works on *https* connections.
 
 ## Installation
 
@@ -18,13 +23,11 @@ And then execute:
 
 ## Usage
 
-Rack U2F has two components;
+Rack U2F has two components; A Rack app to register U2F devices and Rack Middleware to authenticate against registered U2F devices. When registration is enabled, you can add a u2f device through the `u2f_register_path`.
 
-A Rack app to register U2F devices
+For U2F to work, persistence of a counter is required, therefore a storage mechanism is needed. Right now, this gem supports [Redis](https://redis.io), but ActiveRecord support is also planned.
 
-and
-
-Rack middleware to authenticate against registered U2F devices
+## Config
 
 In rails:
 
@@ -40,25 +43,29 @@ config.middleware.use Rack::U2f::AuthenticationMiddleware, {
 }
 ```
 
-Currently only a redis store is developed, but other stores such as active record will be easy to add.
-
-if `enable_registration` is set to `"true"` then you will be able to visit `/_u2f_register` to register a new key.
+The `Rack::U2f::RegistrationStore::RedisStore.new` by default uses `Redis.new` as the redis connection.
+You can pass in your own connection as the single argument to `RedisStore.new()`, for example:
 
-Note: U2F only works on *https* connections.
+```ruby
+store: Rack::U2f::RegistrationStore::RedisStore.new(Redis.new(url: 'redis://10.1.1.1/'))
+```
 
-In addition, the registration depends on the url used to register, so data from one environment will not work on another.
+If `enable_registration` is true then you will be able to visit `/_u2f_register` to register a new key.
+Registration should not be enabled in production. It is possible to mount the registration server separately as it is a rack app.
 
-When authenticated, the session is used to store that fact. *You must be using a secure session store*.
+When authenticated, the session is for further authentication. *You must be using a secure session store*.
 
 ## Development
 
-After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+There is a demo app in the DemoApp folder. Integration tests will require a fake/software u2f key, and is on the TODO list.
+
+## See also
 
-To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
+The [ruby-u2f](https://github.com/castle/ruby-u2f) gem, which this gem depends on.
 
 ## Contributing
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/eadz/rack-u2f.
+Bug reports and pull requests are welcome on GitHub at https://github.com/eadz/rack-u2f
 
 ## License
 

data/lib/rack/u2f/authentication_middleware.rb

@@ -7,6 +7,7 @@ module Rack
       def initialize(app, config = nil)
         @app = app
         @config = config
+        @after_sign_in_path = config[:after_sign_in_path] || '/'
         @u2f_register_path = config[:u2f_register_path] || '/_u2f_register'
         @store = config[:store] || raise('Please specify a U2F store such as Rack::U2f::RegistrationStore::RedisStore.new')
         @exclude_urls = config[:exclude_urls] || []
@@ -15,7 +16,7 @@ module Rack
       def call(env)
         request = Rack::Request.new(env)
         return @app.call(env) if excluded?(request)
-        return RegistrationServer.new(@config).call(env) if request.path == '/_u2f_register'
+        return RegistrationServer.new(@config).call(env) if request.path == @u2f_register_path
         return @app.call(env) if authenticated?(request)
         return resp_auth_from_u2f(request) if request.params['u2f_auth']
         challenge_page(request)
@@ -56,7 +57,7 @@ module Rack
 
         @store.update_registration(key_handle: u2f_response.key_handle, counter: u2f_response.counter)
         request.session['u2f_authenticated'] = true
-        [302, {"Location" => '/'}, []]
+        [302, { "Location" => @after_sign_in_path }, []]
       end
 
       def challenge_page(request)
@@ -75,7 +76,7 @@ module Rack
           u2fjs: U2FJS
         )
 
-        Rack::Response.new(content)
+        Rack::Response.new(content, 403)
       end
     end
   end

data/lib/rack/u2f/registration_store/active_record_store.rb

@@ -1,6 +1,6 @@
 module Rack
   module U2f
-    # Store to keep track of u2f data in active record
+    # Store to keep track of u2f data in active record (WIP)
     module RegistrationStore
       class ActiveRecordStore
         def initialize(ar_model)

data/lib/rack/u2f/version.rb

@@ -1,5 +1,5 @@
 module Rack
   module U2f
-    VERSION = "0.1.1"
+    VERSION = "0.1.2"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack-u2f
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors:
 - Eaden McKee