rails_same_site_cookie 0.1.5 → 0.1.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: d0c2e537b9df7458324fe26f417e12791742a193
-  data.tar.gz: 7f0e758b214264adb777c7fbccd7b08970d641e3
+SHA256:
+  metadata.gz: de603a08185ff1e1df7e28ca0229d6a1f64474336788d233af3a0d647d028868
+  data.tar.gz: f01fc02d4261a916c3b2776fa9bafee35a37d5d00c64592d8ecba0aba4a7def2
 SHA512:
-  metadata.gz: 34e3be281673ffbe03de44c11cb606e25d2d22946760357dc7f3572cc9ced0ad1f9e4c0141c607a008d07fa274fd29ff24a3bfcd191ca58082e2c9559d5472f2
-  data.tar.gz: 6c47a3d87373e137f082fbe99bc70443bfd00674144011a6528e8fe82b497f7921366e573dd695602d8ae9701c126b4a54ab874cc2a7b903ccb2d3a9ad61dfcd
+  metadata.gz: 516d7d5d61abe352bcd927663aec93d85ea0ceffcf254b1816e64168fd627431398dd9a505f7bb4457d53ce093201260039079ef4c69c13739b18a575dbfe357
+  data.tar.gz: 5aa26a4289c6fb3ece3b9438c8e4977dca23fa2cfc9eb4d91ba63a01ac44b969152f77f2de93f7c49864fda29fd9178d55b99172a76bc13479391d39bec51586

data/README.md

@@ -8,8 +8,11 @@ This new behavior shouldn't be a problem for most apps but if your Rails app pro
 
 This gem fixes the above problems by explicity setting SameSite=None for all cookies where the SameSite directive is missing and the requesting user agent is not in Chrome's [provided list of known incompatible clients](https://www.chromium.org/updates/same-site/incompatible-clients).
 
+### Note about incompatibility with Safari and the future of third-party cookies
+Newer versions of Safari [block third party cookies by defaul](https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/) regardless of whether the SameSite flag is set. By design there is no workaround for this without the user manually going in and overriding the default settings to allow cross-site tracking. Chrome also plans to [completely phase out third party cookies in 2022](https://blog.chromium.org/2020/01/building-more-private-web-path-towards.html) at which point this gem will be useless.
+
 ### Note about HTTP requests and local testing
-Note that the gem only sets the "Secure" flag (which Chrome will also require for SameSite=None cookies) on cookies sent over HTTPS. So if you're testing on your local machine and you haven't setup your localhost to use SSL you will see warnings in Chrome about the cookies lacking the Secure flag. If the gem did set this flag in these cases, you would not see the warning and instead the cookies would simply be ignored. Once Chrome 80 is released you will either have to setup SSL on your localhost or start using a different browser for development, because Chrome will begin ignoring these cookies for lacking the Secure flag.
+Note that for Chrome/Chromium based browsers the gem only sets the SameSite flag on cookies sent over HTTPS. So if you're testing on your local machine and you haven't setup your localhost to use SSL you will see warnings in versions of Chrome less than 80 about the missing SameSite flag, and in Chrome 80+ these cookies will be ignored entirely. To work around this in Chrome 80+ without setting up SSL you can disable the following Chrome flags: chrome://flags/ -> `SameSite by default cookies` and `Cookies without SameSite must be secure`.
 
 ## Installation
 

data/lib/rails_same_site_cookie/middleware.rb

@@ -13,14 +13,17 @@ module RailsSameSiteCookie
       status, headers, body = @app.call(env)
 
       regex = RailsSameSiteCookie.configuration.user_agent_regex
-      if headers['Set-Cookie'].present? and (regex.nil? or regex.match(env['HTTP_USER_AGENT']))
+      set_cookie = headers['Set-Cookie']
+      if (regex.nil? or regex.match(env['HTTP_USER_AGENT'])) and not (set_cookie.nil? or set_cookie.strip == '')
         parser = UserAgentChecker.new(env['HTTP_USER_AGENT'])
         if parser.send_same_site_none?
-          cookies = headers['Set-Cookie'].split(COOKIE_SEPARATOR)
+          cookies = set_cookie.split(COOKIE_SEPARATOR)
           ssl = Rack::Request.new(env).ssl?
 
           cookies.each do |cookie|
-            next if cookie.blank?
+            next if cookie == '' or cookie.nil?
+            next if !ssl && parser.chrome? # https://www.chromestatus.com/feature/5633521622188032
+
             if ssl and not cookie =~ /;\s*secure/i
               cookie << '; Secure'
             end

data/lib/rails_same_site_cookie/user_agent_checker.rb

@@ -21,6 +21,10 @@ module RailsSameSiteCookie
       return !missing_same_site_none_support?
     end
 
+    def chrome?
+      is_chromium_based?
+    end
+
     private
     def missing_same_site_none_support?
       has_webkit_ss_bug? or drops_unrecognized_ss_cookies?

data/lib/rails_same_site_cookie/version.rb

@@ -1,3 +1,3 @@
 module RailsSameSiteCookie
-  VERSION = "0.1.5"
+  VERSION = "0.1.9"
 end

data/rails_same_site_cookie.gemspec

@@ -28,6 +28,6 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "rake", "~> 10.0"
   spec.add_development_dependency "rspec", "~> 3.0"
 
-  spec.add_dependency "railties", ">= 4.1"
-  spec.add_dependency "user_agent_parser", "~> 2.5"
+  spec.add_dependency "rack", ">= 1.5"
+  spec.add_dependency "user_agent_parser", "~> 2.6"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rails_same_site_cookie
 version: !ruby/object:Gem::Version
-  version: 0.1.5
+  version: 0.1.9
 platform: ruby
 authors:
 - Philip Schinis
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-01-31 00:00:00.000000000 Z
+date: 2021-09-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -53,33 +53,33 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '3.0'
 - !ruby/object:Gem::Dependency
-  name: railties
+  name: rack
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '4.1'
+        version: '1.5'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '4.1'
+        version: '1.5'
 - !ruby/object:Gem::Dependency
   name: user_agent_parser
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.5'
+        version: '2.6'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.5'
+        version: '2.6'
 description: 
 email:
 - p.schinis@gmail.com
@@ -125,8 +125,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.5.1
+rubygems_version: 3.1.2
 signing_key: 
 specification_version: 4
 summary: This gem allows you to set the SameSite=None cookie directive without breaking