ruby_native 0.1.6 → 0.1.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 32b197c0a8f99c04712f2b136abc4ba70b5dda8b58a0d63059c175f7fce5bd63
-  data.tar.gz: 8dee5f928a417ec72888085d7016b92af0b94f41dafcdbfb798914c00f99cbe5
+  metadata.gz: d9b49c97d0f100aa8dc0964d9701187edaa62441f0a1c8d0049233ce8b5fa3c2
+  data.tar.gz: b5cce869ec41fda99a9ec98f8b7e930a3b410fadc0103dba4392a75e339ae51b
 SHA512:
-  metadata.gz: 8ac660e5e1bd0ef3a34b148f23731d3dbe0afddc3a44f7b0a83dd9f7ca41f157d9bd1dfd0f41a9e1de4cbebd6a8b9b19c20fc1d344fadec8df3b72c4d5d84bfe
-  data.tar.gz: 502a6f79480870006ca3dd30b58a2744c5f55b49f3662322d67b8bd4585c760c6a82eb84bb3e804334817a376cd3352e03f7f9b3a454a2b1d2ee355f1343eca4
+  metadata.gz: bd3606567a7f826d197e947c5f059fe25ecd31be3a90f0b04f97c9c694bba417fac707419a7bbc20fe2c40a73d648ef4c35052b834c1ac31c927edcb86f7e996
+  data.tar.gz: 6c349b9fa7c260c6b49f2e0af984b7ef8ee1c2bcedf4fb9ce87f1634d7f1fdb0dbc948e698c909a1bdc812603979732b34e760ff470a0e6ac2adfbad67d8c7ca

data/lib/ruby_native/oauth_middleware.rb

@@ -8,12 +8,17 @@ module RubyNative
 
     def call(env)
       request = ActionDispatch::Request.new(env)
-      started_oauth = oauth_start_request?(request)
-      callback_scheme = request.params["callback_scheme"] if started_oauth
+      on_oauth_path = oauth_path?(request)
+      started_native_oauth = on_oauth_path && request.params["ruby_native"] == "1"
+      callback_scheme = request.params["callback_scheme"] if started_native_oauth
 
       status, headers, body = @app.call(env)
 
-      if started_oauth && callback_scheme.present? && redirect?(status)
+      if on_oauth_path && redirect?(status)
+        relax_cookie_samesite!(headers)
+      end
+
+      if started_native_oauth && callback_scheme.present? && redirect?(status)
         Rails.logger.debug { "[RubyNative] OAuth started for #{request.path}, setting tracking cookie" }
         set_cookie(headers, callback_scheme)
       end
@@ -65,9 +70,8 @@ module RubyNative
 
     private
 
-    def oauth_start_request?(request)
-      return false unless oauth_paths.any? { |p| request.path == p }
-      request.params["ruby_native"] == "1"
+    def oauth_path?(request)
+      oauth_paths.any? { |p| request.path == p }
     end
 
     def set_cookie(headers, callback_scheme)
@@ -76,8 +80,8 @@ module RubyNative
         value: signed,
         path: "/",
         httponly: true,
-        secure: Rails.env.production?,
-        same_site: :lax,
+        secure: true,
+        same_site: :none,
         max_age: 300
       })
     end
@@ -102,6 +106,23 @@ module RubyNative
       )
     end
 
+    # Apple Sign In uses form_post (a cross-origin POST callback).
+    # SameSite=Lax cookies are not sent on cross-origin POSTs, which
+    # breaks OmniAuth's state verification. Relax existing cookies
+    # to SameSite=None so the session cookie survives Apple's callback.
+    def relax_cookie_samesite!(headers)
+      raw = headers["set-cookie"]
+      return unless raw
+
+      cookies = raw.is_a?(Array) ? raw : raw.split("\n")
+      headers["set-cookie"] = cookies.map { |cookie|
+        next cookie unless cookie.match?(/SameSite=Lax/i)
+        cookie.gsub(/SameSite=Lax/i, "SameSite=None").then { |c|
+          c.include?("Secure") ? c : "#{c}; Secure"
+        }
+      }.join("\n")
+    end
+
     def redirect?(status)
       (300..399).cover?(status)
     end

data/lib/ruby_native/version.rb

@@ -1,3 +1,3 @@
 module RubyNative
-  VERSION = "0.1.6"
+  VERSION = "0.1.8"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby_native
 version: !ruby/object:Gem::Version
-  version: 0.1.6
+  version: 0.1.8
 platform: ruby
 authors:
 - Joe Masilotti