rack_encrypted_cookie 0.1.1 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 37f851fd1c4669c9aaa27891cd6e1999b02288b9
-  data.tar.gz: 315f45d56f3d7d95f8e01932c618bc63f0740206
+  metadata.gz: 3a56244311887c06f5a713734e8cf1680db23649
+  data.tar.gz: c0bcaea9daa22d73887e2d1e859cc516eb8250e0
 SHA512:
-  metadata.gz: 336e1835ccfd59a16cc4a9098586ed8ceb8858d65f52636a8295a6684c17bb4e2aa1ff3045b49b9226ac8c203a2759022f1fc5bc846ee2f09ae9f0832e61debc
-  data.tar.gz: 12c70b46342d8090e71e1446ef11a7b0cc4ee5d7db65553073aee4c7c2008cca8c1d6a94d15afacc0a3fed125aa67a2ec01ae3212041a84c30f7a6695d7f89c5
+  metadata.gz: 88a3bbcec54ea098875da7d613cff4320071fb0589ed210eb7365115d61a5e483d3d0f5e9c201cbfa8902b1f5781f7b6c0bc65c48d8b5aa640852ce19b09b46e
+  data.tar.gz: 9f7da1a3c229c1fa8df184fcd84b92701dffd1b2674be33c2f0af5f05ec31e8908c4220eae0a6733ca0e05116ce66bbeb001515a3971700d2335f6ad2277df81

data/lib/rack/session/encrypted_cookie.rb

@@ -2,78 +2,33 @@
 require 'rack/session/cookie'
 require 'openssl'
 require 'base64'
+require 'coder_decorator'
 
 module Rack
   module Session
     class EncryptedCookie < Cookie #:nodoc:
+      Coders = CoderDecorator::Coders
       def initialize(app, options = {})
-        super
-        @salt = options.fetch(:salt, 'encrypted cookie')
-        @signed_salt = options.fetch(:signed_salt, 'signed encrypted cookie')
+        @secret_key_bases = options.values_at(:secret, :old_secret).compact
+        return super if @secret_key_bases.empty?
         @iterations = options.fetch(:iterations, 1024)
         @key_size = options.fetch(:key_size, 64)
-        @cipher = OpenSSL::Cipher::Cipher.new(options.fetch(:cipher, 'AES-256-CBC'))
-        @cipher_secrets = @secrets.map { |secret| generate_key(secret, @salt) }
-        @secrets.map! { |secret| generate_key(secret, @signed_salt) }
+        cipher = options.fetch(:cipher, 'AES-256-CBC')
+        digest = options.fetch(:digest, 'SHA1')
+        salt = options.fetch(:salt, 'encrypted cookie')
+        signed_salt = options.fetch(:signed_salt, 'signed encrypted cookie')
+        cipher_secrets = @secret_key_bases.map { |secret_key_base| generate_key(secret_key_base, salt) }
+        sign_secrets = @secret_key_bases.map { |secret_key_base| generate_key(secret_key_base, signed_salt) }
+        encrypted_coder = Coders::Cipher.new(Coders::Marshal.new, secret: cipher_secrets.first, old_secret: cipher_secrets.last, cipher: cipher)
+        signed_coder = Coders::HMAC.new(encrypted_coder, secret: sign_secrets.first, old_secret: sign_secrets.last, digest: digest)
+        options[:coder] = Coders::Rescue.new(signed_coder)
+        options[:let_coder_handle_secure_encoding] = true
+        super
+        @secrets = [] # hack, lie to Rack::Session that there is no @secrets
       end
 
       private
 
-      def unpacked_cookie_data(request)
-        request.fetch_header(RACK_SESSION_UNPACKED_COOKIE_DATA) do |k|
-          session_data = request.cookies[@key]
-
-          if !@secrets.empty? && session_data
-            digest, session_data = session_data.reverse.split('--', 2)
-            digest&.reverse!
-            session_data&.reverse!
-            session_data = nil unless digest_match?(session_data, digest)
-          end
-
-          if !@cipher_secrets.empty? && session_data
-            encrypted_data, iv = ::Base64.strict_decode64(session_data).split('--').map! { |v| ::Base64.strict_decode64(v) }
-
-            @cipher_secrets.each do |cipher_secret|
-              @cipher.decrypt
-              @cipher.key = cipher_secret
-              @cipher.iv  = iv
-              begin
-                session_data = @cipher.update(encrypted_data) << @cipher.final
-                break
-              rescue OpenSSL::Cipher::CipherError
-                next
-              end
-            end
-          end
-          request.set_header(k, coder.decode(session_data) || {})
-        end
-      end
-
-      def write_session(req, session_id, session, _options)
-        session = session.merge('session_id' => session_id)
-        session_data = coder.encode(session)
-
-        if @cipher_secrets.first
-          @cipher.encrypt
-          @cipher.key = @cipher_secrets.first
-          iv = @cipher.random_iv
-          encrypted_data = @cipher.update(session_data) << @cipher.final
-          blob = "#{::Base64.strict_encode64 encrypted_data}--#{::Base64.strict_encode64 iv}"
-          session_data = ::Base64.strict_encode64(blob)
-        end
-
-        if @secrets.first
-          session_data << "--#{generate_hmac(session_data, @secrets.first)}"
-        end
-
-        if session_data.size > (4096 - @key.size)
-          req.get_header(RACK_ERRORS).puts('Warning! Rack::Session::Cookie data size exceeds 4K.')
-          nil
-        else
-          session_data
-        end
-      end
-
       def generate_key(secret, salt)
         OpenSSL::PKCS5.pbkdf2_hmac_sha1(secret, salt, @iterations, @key_size)
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack_encrypted_cookie
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 1.0.0
 platform: ruby
 authors:
 - Jian Weihang
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-12-05 00:00:00.000000000 Z
+date: 2016-12-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -24,6 +24,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: coder_decorator
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.0.2
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.0.2
 - !ruby/object:Gem::Dependency
   name: minitest
   requirement: !ruby/object:Gem::Requirement
@@ -94,7 +108,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.4
+rubygems_version: 2.6.8
 signing_key: 
 specification_version: 4
 summary: Rack middleware for signed encrypted session cookie.