rack_csrf 1.0.0 → 1.0.1

data/Manifest

@@ -13,6 +13,7 @@ features/step_definitions/request_steps.rb
 features/step_definitions/response_steps.rb
 features/step_definitions/setup_steps.rb
 features/support/env.rb
+features/variation_on_field_name.feature
 lib/rack/csrf.rb
 lib/rack/vendor/securerandom.rb
 LICENSE.rdoc

data/Rakefile

@@ -11,7 +11,7 @@ Spec::Rake::SpecTask.new do |t|
   t.spec_opts = %w(-O spec/spec.opts)
 end
 
-Echoe.new('rack_csrf', '1.0.0') do |s|
+Echoe.new('rack_csrf', '1.0.1') do |s|
   s.author = 'Emanuele Vicentini'
   s.email = 'emanuele.vicentini@gmail.com'
   s.summary = 'Anti-CSRF Rack middleware'

data/features/setup.feature

@@ -22,3 +22,8 @@ Feature: Setup of the middleware
       | POST:/not_checking |
       | PUT:/is_wrong      |
     Then I get a fully functional rack
+
+  Scenario: Setup with the :field option
+    Given a Rack setup with the session middleware
+    When I insert the anti-CSRF middleware with the :field option
+    Then I get a fully functional rack

data/features/skip_some_routes.feature

@@ -1,6 +1,6 @@
 Feature: Skipping the check for some specific routes
 
-  Scenario Outline: Skipping the check for a some requests
+  Scenario Outline: Skipping the check for some requests
     Given a Rack setup with the anti-CSRF middleware and the :skip option
       | pair               |
       | POST:/not_checking |

data/features/step_definitions/request_steps.rb

@@ -31,7 +31,8 @@ end
 When /^it receives a (POST|PUT|DELETE) request with the right CSRF token$/ do |http_method|
   http_method.downcase!
   @response = Rack::MockRequest.new(@app).send http_method.to_sym, '/',
-    :input => "#{Rack::Csrf.csrf_field}=right_token"
+    :input => "#{Rack::Csrf.csrf_field}=right_token",
+    'rack.session' => {'csrf.token' => 'right_token'}
 end
 
 When /^it receives a (POST|PUT|DELETE) request with the wrong CSRF token$/ do |http_method|

data/features/step_definitions/setup_steps.rb

@@ -1,16 +1,6 @@
 Given /^a Rack setup (with|without) the session middleware$/ do |prep|
   @rack_builder = Rack::Builder.new
-  @rack_builder.use Rack::Session::Cookie if prep == 'with'
-end
-
-class CsrfFaker
-  def initialize(app)
-    @app = app
-  end
-  def call(env)
-    env['rack.session']['rack.csrf'] = 'right_token'
-    @app.call(env)
-  end
+  @rack_builder.use FakeSession if prep == 'with'
 end
 
 # Yes, they're not as DRY as possible, but I think they're more readable than
@@ -18,22 +8,24 @@ end
 
 Given /^a Rack setup with the anti\-CSRF middleware$/ do
   Given 'a Rack setup with the session middleware'
-  @rack_builder.use CsrfFaker
   When 'I insert the anti-CSRF middleware'
 end
 
 Given /^a Rack setup with the anti\-CSRF middleware and the :raise option$/ do
   Given 'a Rack setup with the session middleware'
-  @rack_builder.use CsrfFaker
   When 'I insert the anti-CSRF middleware with the :raise option'
 end
 
 Given /^a Rack setup with the anti\-CSRF middleware and the :skip option$/ do |table|
   Given 'a Rack setup with the session middleware'
-  @rack_builder.use CsrfFaker
   When 'I insert the anti-CSRF middleware with the :skip option', table
 end
 
+Given /^a Rack setup with the anti\-CSRF middleware and the :field option$/ do
+  Given 'a Rack setup with the session middleware'
+  When 'I insert the anti-CSRF middleware with the :field option'
+end
+
 # Yes, they're not as DRY as possible, but I think they're more readable than
 # a single step definition with a few captures and more complex checkings.
 
@@ -59,6 +51,13 @@ When /^I insert the anti\-CSRF middleware with the :skip option$/ do |table|
   @app = @rack_builder.to_app
 end
 
+When /^I insert the anti\-CSRF middleware with the :field option$/ do
+  @rack_builder.use Rack::Lint
+  @rack_builder.use Rack::Csrf, :field => 'fantasy_name'
+  @rack_builder.run(lambda {|env| Rack::Response.new('Hello world!').finish})
+  @app = @rack_builder.to_app
+end
+
 Then /^I get a fully functional rack$/ do
   lambda {Rack::MockRequest.new(@app).get('/')}.should_not raise_error
 end

data/features/support/env.rb

@@ -2,3 +2,15 @@ require 'rubygems'
 require 'spec/expectations'
 
 require File.dirname(__FILE__) + "/../../lib/rack/csrf"
+
+# Simulated session used just to be able to insert data into it without seeing
+# them wiped out.
+class FakeSession
+  def initialize(app)
+    @app = app
+  end
+  def call(env)
+    env['rack.session'] ||= Hash.new
+    @app.call(env)
+  end
+end

data/features/variation_on_field_name.feature

@@ -0,0 +1,29 @@
+Feature: Customization of the field name
+
+  Scenario: GET request with CSRF token in custom field
+    Given a Rack setup with the anti-CSRF middleware and the :field option
+    When it receives a GET request with the CSRF token
+    Then it lets it pass untouched
+
+  Scenario Outline: Handling request with the right CSRF token in custom field
+    Given a Rack setup with the anti-CSRF middleware and the :field option
+    When it receives a <method> request with the right CSRF token
+    Then it lets it pass untouched
+
+    Examples:
+      | method |
+      | POST   |
+      | PUT    |
+      | DELETE |
+
+  Scenario Outline: Handling request with the wrong CSRF token in custom field
+    Given a Rack setup with the anti-CSRF middleware and the :field option
+    When it receives a <method> request with the wrong CSRF token
+    Then it responds with 417
+    And the response body is empty
+
+    Examples:
+      | method |
+      | POST   |
+      | PUT    |
+      | DELETE |

data/lib/rack/csrf.rb

@@ -24,9 +24,10 @@ module Rack
       unless env['rack.session']
         raise SessionUnavailable.new('Rack::Csrf depends on session middleware')
       end
+      self.class.csrf_token(env)
       req = Rack::Request.new(env)
       untouchable = !%w(POST PUT DELETE).include?(req.request_method) ||
-        req.POST[self.class.csrf_field] == env['rack.session']['rack.csrf'] ||
+        req.POST[self.class.csrf_field] == env['rack.session']['csrf.token'] ||
         skip_checking(req)
       if untouchable
         @app.call(env)
@@ -41,7 +42,7 @@ module Rack
     end
 
     def self.csrf_token(env)
-      env['rack.session']['rack.csrf'] ||= SecureRandom.base64(32)
+      env['rack.session']['csrf.token'] ||= SecureRandom.base64(32)
     end
 
     def self.csrf_tag(env)

data/rack_csrf.gemspec

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification 
 name: rack_csrf
 version: !ruby/object:Gem::Version 
-  version: 1.0.0
+  version: 1.0.1
 platform: ruby
 authors: 
 - Emanuele Vicentini
 autorequire: 
 bindir: bin
 
-date: 2009-04-22 00:00:00 +02:00
+date: 2009-05-02 00:00:00 +02:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -86,6 +86,7 @@ files:
 - features/step_definitions/response_steps.rb
 - features/step_definitions/setup_steps.rb
 - features/support/env.rb
+- features/variation_on_field_name.feature
 - lib/rack/csrf.rb
 - lib/rack/vendor/securerandom.rb
 - LICENSE.rdoc

data/spec/csrf_spec.rb

@@ -26,13 +26,13 @@ describe Rack::Csrf do
       @env['rack.session'].should be_empty
       Rack::Csrf.csrf_token(@env)
       @env['rack.session'].should_not be_empty
-      @env['rack.session']['rack.csrf'].should_not be_empty
+      @env['rack.session']['csrf.token'].should_not be_empty
     end
 
     it 'should get the token from the session if it is already there' do
       @env['rack.session'].should be_empty
       csrf_token = Rack::Csrf.csrf_token(@env)
-      csrf_token.should == @env['rack.session']['rack.csrf']
+      csrf_token.should == @env['rack.session']['csrf.token']
       csrf_token.should == Rack::Csrf.csrf_token(@env)
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: rack_csrf
 version: !ruby/object:Gem::Version 
-  version: 1.0.0
+  version: 1.0.1
 platform: ruby
 authors: 
 - Emanuele Vicentini
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2009-04-22 00:00:00 +02:00
+date: 2009-05-02 00:00:00 +02:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -87,6 +87,7 @@ files:
 - features/step_definitions/response_steps.rb
 - features/step_definitions/setup_steps.rb
 - features/support/env.rb
+- features/variation_on_field_name.feature
 - lib/rack/csrf.rb
 - lib/rack/vendor/securerandom.rb
 - LICENSE.rdoc