rodauth-select-account 0.0.3 → 0.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 73c3033c2a25680b2abc54db4f4f55cc9e11698d699bd70745c97184ca5a6c7e
-  data.tar.gz: 1a94b7a28d85b55fbad68eb9800407552d9f5f2b281c84842af829174967451b
+  metadata.gz: 6c881e5c48400dfdb20e8c6d4c085ca195fe901477ac632cbc901217ab745b34
+  data.tar.gz: 8af197d3e4766928985775c4532954d3c7f519231872b1875411936b80c46fb6
 SHA512:
-  metadata.gz: 35e2e1d8c4d162cfb0d95f1a1bc1293f9002718bc58619fd6edcebdde7fe0b71588596dbb59a167ebf82400b6d74dd6202c03707949de276fca92bf0355a4250
-  data.tar.gz: c000c0f422f9aee6ee6d2278d77523520e7910de79ed528ccf676f4a59ee973d1e8787f53f13ca0edd51d714a751938b3344f7fa9b3dae77dcc853bd9e65d037
+  metadata.gz: a65a384392c409fba38c4d04087c59bd78a278fa795924414c7ff4e3269191bf07a271e448e800d843332d6e70c3bfadb861b69c64fb09d841d6b2ec15cd11df
+  data.tar.gz: e7ebbc98509dea51383abc86fe54f633620e5f2e16b2fa503a68c14754f8aef75016cca9d54717c26e93ac3ddae85b0880bb10060397ffcc5eed56468658b690

data/CHANGELOG.md

@@ -1,3 +1,21 @@
 # CHANGELOG
 
 ## master
+
+## 0.0.4
+
+Cookies used for selected account are now secure by default (httponly on, secure if request is TLS-enabled);
+
+Cookie path is now "/" by default.
+
+## 0.0.3
+
+bugfix: fixing calls to the view helpers when in multi-phase login mode.
+
+## 0.0.2
+
+bugfix: added missing form templates.
+
+## 0.0.1
+
+Initial draft, all features added.

data/README.md

@@ -127,7 +127,7 @@ These are also available methods:
 
 ## Ruby support policy
 
-The minimum Ruby version required to run `rodauth-select-account` is 2.4 . Besides that, it should support all rubies that rodauth and roda support, including JRuby and (potentially, I don't know yet) truffleruby.
+The minimum Ruby version required to run `rodauth-select-account` is 2.4 . Besides that, it supports all rubies that rodauth and roda support, including JRuby and truffleruby.
 
 ## Development
 

data/lib/rodauth/features/select_account.rb

@@ -54,15 +54,18 @@ module Rodauth
     def require_select_account
       # whether an account has been selected for a certain workflow will be driven by a short-lived
       # cookie, which will hopefully be active during the duration of account selection
+      opts = Hash[accounts_cookie_options]
+      opts[:path] = "/" unless opts.key?(:path)
       if request.cookies[require_selected_account_cookie_key]
-        ::Rack::Utils.delete_cookie_header!(response.headers, require_selected_account_cookie_key)
+        ::Rack::Utils.delete_cookie_header!(response.headers, require_selected_account_cookie_key, opts)
         return
       end
 
-      opts = {
-        value: true,
-        expires: Time.now + require_selected_account_cookie_interval
-      }
+      opts[:value] = true
+      opts[:expires] = Time.now + require_selected_account_cookie_interval
+      opts[:httponly] = true unless opts.key?(:httponly)
+      opts[:secure] = true unless opts.key?(:secure) || !request.ssl?
+
       ::Rack::Utils.set_cookie_header!(response.headers, require_selected_account_cookie_key, opts)
 
       # should redirect to the accounts page, and set this as the page to return to
@@ -170,6 +173,9 @@ module Rodauth
       opts = Hash[accounts_cookie_options]
       opts[:value] = accounts_cookie.join(",")
       opts[:expires] = Time.now + accounts_cookie_interval
+      opts[:path] = "/" unless opts.key?(:path)
+      opts[:httponly] = true unless opts.key?(:httponly)
+      opts[:secure] = true unless opts.key?(:secure) || !request.ssl?
       ::Rack::Utils.set_cookie_header!(response.headers, accounts_cookie_key, opts)
     end
 

data/lib/rodauth/select-account/version.rb

@@ -2,6 +2,6 @@
 
 module Rodauth
   module SelectAccount
-    VERSION = "0.0.3"
+    VERSION = "0.0.4"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rodauth-select-account
 version: !ruby/object:Gem::Version
-  version: 0.0.3
+  version: 0.0.4
 platform: ruby
 authors:
 - Tiago Cardoso
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-09-21 00:00:00.000000000 Z
+date: 2021-01-16 00:00:00.000000000 Z
 dependencies: []
 description: Multiple authenticated accounts per session in rodauth.
 email:
@@ -50,7 +50,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.2
+rubygems_version: 3.1.4
 signing_key:
 specification_version: 4
 summary: Multiple authenticated accounts per session in rodauth.