rails_same_site_cookie 0.1.8 → 0.1.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 618cf5109f133dcb39a5d87e17f20efe177cad03
-  data.tar.gz: 5a4f0cc5a8db31861d286304071168b09ed4a307
+SHA256:
+  metadata.gz: d6fa81378a73177217ee8a6cf22b3393972b6f675a579eb72f9e76eeecd5274a
+  data.tar.gz: 1299774e31c995474be51d4bbe8926cc0f7b6a2cf6acf0864358d84e5d17f6aa
 SHA512:
-  metadata.gz: 8aa434cfd9495919993399d8644546c9c978794331cc6a32d4f429d8498949aab74d240d0b56f683a0a1e0d1929a22346170e389556d814a865bfb5b352cce6a
-  data.tar.gz: 7bb3208e5804dd672a429e62297f55ac3da376b0200d6d5cac93eca77aa0c88e9374cf11336e3307c24ea7d1d36735d3172b03352f95a282bff244d1c9c0f98d
+  metadata.gz: '08900401473433c96bc4293cfee4ab587ceff0bced274314512408969c23e5b7a57ee6922d501f7dfeebbae0c16342ef12ceccd128252940802d8f29473e9151'
+  data.tar.gz: afa375b09d3f965bebff85cc2f3b7622600d8d86a89083c66bd5f6a5191ead709803a93e9d6ba7a3c7ca7ce9cabf72ed7ec8cd31bef3c6ec502d3b8dc0f799dc

data/README.md

@@ -8,6 +8,9 @@ This new behavior shouldn't be a problem for most apps but if your Rails app pro
 
 This gem fixes the above problems by explicity setting SameSite=None for all cookies where the SameSite directive is missing and the requesting user agent is not in Chrome's [provided list of known incompatible clients](https://www.chromium.org/updates/same-site/incompatible-clients).
 
+### Note about incompatibility with Safari and the future of third-party cookies
+Newer versions of Safari [block third party cookies by default](https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/) regardless of whether the SameSite flag is set. By design there is no workaround for this without the user manually going in and overriding the default settings to allow cross-site tracking. Chrome also plans to [completely phase out third party cookies in 2022](https://blog.chromium.org/2020/01/building-more-private-web-path-towards.html) at which point this gem will be useless.
+
 ### Note about HTTP requests and local testing
 Note that for Chrome/Chromium based browsers the gem only sets the SameSite flag on cookies sent over HTTPS. So if you're testing on your local machine and you haven't setup your localhost to use SSL you will see warnings in versions of Chrome less than 80 about the missing SameSite flag, and in Chrome 80+ these cookies will be ignored entirely. To work around this in Chrome 80+ without setting up SSL you can disable the following Chrome flags: chrome://flags/ -> `SameSite by default cookies` and `Cookies without SameSite must be secure`.
 

data/lib/rails_same_site_cookie/middleware.rb

@@ -14,10 +14,11 @@ module RailsSameSiteCookie
 
       regex = RailsSameSiteCookie.configuration.user_agent_regex
       set_cookie = headers['Set-Cookie']
-      if (regex.nil? or regex.match(env['HTTP_USER_AGENT'])) and not (set_cookie.nil? or set_cookie.strip == '')
+      set_cookie_is_array = set_cookie.is_a?(Array)
+      if (regex.nil? or regex.match(env['HTTP_USER_AGENT'])) and not (set_cookie.nil? or (set_cookie_is_array ? set_cookie.empty? : set_cookie.strip == ''))
         parser = UserAgentChecker.new(env['HTTP_USER_AGENT'])
         if parser.send_same_site_none?
-          cookies = set_cookie.split(COOKIE_SEPARATOR)
+          cookies = set_cookie_is_array ? set_cookie : set_cookie.split(COOKIE_SEPARATOR)
           ssl = Rack::Request.new(env).ssl?
 
           cookies.each do |cookie|
@@ -34,7 +35,7 @@ module RailsSameSiteCookie
 
           end
 
-          headers['Set-Cookie'] = cookies.join(COOKIE_SEPARATOR)
+          headers['Set-Cookie'] = set_cookie_is_array ? cookies : cookies.join(COOKIE_SEPARATOR)
         end
       end
 
@@ -42,4 +43,4 @@ module RailsSameSiteCookie
     end
 
   end
-end
+end

data/lib/rails_same_site_cookie/version.rb

@@ -1,3 +1,3 @@
 module RailsSameSiteCookie
-  VERSION = "0.1.8"
+  VERSION = "0.1.10"
 end

data/rails_same_site_cookie.gemspec

@@ -29,5 +29,5 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "rspec", "~> 3.0"
 
   spec.add_dependency "rack", ">= 1.5"
-  spec.add_dependency "user_agent_parser", "~> 2.5"
+  spec.add_dependency "user_agent_parser", "~> 2.6"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rails_same_site_cookie
 version: !ruby/object:Gem::Version
-  version: 0.1.8
+  version: 0.1.10
 platform: ruby
 authors:
 - Philip Schinis
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2020-03-21 00:00:00.000000000 Z
+date: 2025-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -72,15 +72,15 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.5'
+        version: '2.6'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.5'
-description: 
+        version: '2.6'
+description:
 email:
 - p.schinis@gmail.com
 executables: []
@@ -110,7 +110,7 @@ licenses:
 metadata:
   homepage_uri: https://github.com/pschinis/rails_same_site_cookie
   source_code_uri: https://github.com/pschinis/rails_same_site_cookie
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -125,9 +125,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.5.1
-signing_key: 
+rubygems_version: 3.1.2
+signing_key:
 specification_version: 4
 summary: This gem allows you to set the SameSite=None cookie directive without breaking
   browsers that don't support it.