rack_encrypted_cookie 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 23f35d46ff17b90a24e7af57a88ccc537c6313cc
+  data.tar.gz: 2f9efc7904c1716376024d167aeffd377edabb35
+SHA512:
+  metadata.gz: 2f2eca097ad9d4cbd671ec96dda484f539cfbc2c163e3e7ae3e8e4ae1161bac7f6e3223d9ca23869989d2a81a655b248ee6c73a64be74cf52eb174d8527087f1
+  data.tar.gz: 5c7db236e99c36ebba040b4532d5c8f9a37130b54c2082235d900ce42306a2cdeaa5652c70fb1770790fa03e849beba31316f9fdd2662ed134241ca2b7109062

data/lib/rack/session/encrypted_cookie.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+require 'rack/session/cookie'
+require 'openssl'
+require 'base64'
+
+module Rack
+  module Session
+    class EncryptedCookie < Cookie #:nodoc:
+      def initialize(app, options = {})
+        super
+        @salt = options.fetch(:salt, 'encrypted cookie')
+        @signed_salt = options.fetch(:signed_salt, 'signed encrypted cookie')
+        @iterations = options.fetch(:iterations, 1024)
+        @key_size = options.fetch(:key_size, 64)
+        @cipher = OpenSSL::Cipher::Cipher.new(options.fetch(:cipher, 'AES-256-CBC'))
+        @cipher_secrets = @secrets.map { |secret| generate_key(secret, @salt) }
+        @secrets.map! { |secret| generate_key(secret, @signed_salt) }
+      end
+
+      private
+
+      def unpacked_cookie_data(request)
+        request.fetch_header(RACK_SESSION_UNPACKED_COOKIE_DATA) do |k|
+          session_data = request.cookies[@key]
+
+          if !@secrets.empty? && session_data
+            digest, session_data = session_data.reverse.split('--', 2)
+            digest&.reverse!
+            session_data&.reverse!
+            session_data = nil unless digest_match?(session_data, digest)
+          end
+
+          if !@cipher_secrets.empty? && session_data
+            encrypted_data, iv = ::Base64.strict_decode64(session_data).split('--').map! { |v| ::Base64.strict_decode64(v) }
+
+            @cipher_secrets.each do |cipher_secret|
+              @cipher.decrypt
+              @cipher.key = cipher_secret
+              @cipher.iv  = iv
+              begin
+                session_data = @cipher.update(encrypted_data) << @cipher.final
+                break
+              rescue OpenSSL::Cipher::CipherError
+                next
+              end
+            end
+          end
+          request.set_header(k, coder.decode(session_data) || {})
+        end
+      end
+
+      def write_session(req, session_id, session, _options)
+        session = session.merge('session_id' => session_id)
+        session_data = coder.encode(session)
+
+        if @cipher_secrets.first
+          @cipher.encrypt
+          @cipher.key = @cipher_secrets.first
+          iv = @cipher.random_iv
+          encrypted_data = @cipher.update(session_data) << @cipher.final
+          blob = "#{::Base64.strict_encode64 encrypted_data}--#{::Base64.strict_encode64 iv}"
+          session_data = ::Base64.strict_encode64(blob)
+        end
+
+        if @secrets.first
+          session_data << "--#{generate_hmac(session_data, @secrets.first)}"
+        end
+
+        if session_data.size > (4096 - @key.size)
+          req.get_header(RACK_ERRORS).puts('Warning! Rack::Session::Cookie data size exceeds 4K.')
+          nil
+        else
+          session_data
+        end
+      end
+
+      def generate_key(secret, salt)
+        OpenSSL::PKCS5.pbkdf2_hmac_sha1(secret, salt, @iterations, @key_size)
+      end
+    end
+  end
+end

metadata

@@ -0,0 +1,100 @@
+--- !ruby/object:Gem::Specification
+name: rack_encrypted_cookie
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Jian Weihang
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2016-12-05 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: minitest
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rubocop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: Rack middleware for signed encrypted session cookie.
+email: tonytonyjan@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/rack/session/encrypted_cookie.rb
+homepage: 
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 2.3.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.6.4
+signing_key: 
+specification_version: 4
+summary: Rack middleware for signed encrypted session cookie.
+test_files: []