safe_cookies 0.2.1 → 0.2.2

checksums.yaml

@@ -1,15 +1,7 @@
 ---
-!binary "U0hBMQ==":
-  metadata.gz: !binary |-
-    YWE0YmVmNWE0NjE3N2ZiYWUzNDM2ODYwMDFhNGNkYTE1Yzc2ZjllYQ==
-  data.tar.gz: !binary |-
-    NDliMDkwMDFjOTMxZDVhNmU4NjgyZDgxZTQ1OWQ1N2E4NjFhNmZmYw==
+SHA256:
+  metadata.gz: 7175011cd4a253c98779e5fdb5d221ea99dbbe5708e3a9dce37547ac89d29361
+  data.tar.gz: 08e2daf10fdd7ec2a115162969eaffd241edca9f82671a146bfafd381bd9f7a3
 SHA512:
-  metadata.gz: !binary |-
-    YzYxNGU4MmIyNjg1MDhjNzM0ZjRmNWMxZGYwNmM4MDUxYmMwNDE0ZDRiYmQx
-    YmY0NTdiOGUxODQ4NWFiOTUzOTUyMjM0MTU2ZWUyOGQ3OGUxYjZhMDYzZGFk
-    ZDc5NTcwYjg2Zjc5MWM0MzgwMGE3YTA2NGMyZmQxYmIyOTg5NGY=
-  data.tar.gz: !binary |-
-    NWI3YmNhNzE2ODI1YzQ2ZGQ0NTk3NTAxODg5MTFhMWI0MDIxYWJmODNlZTU2
-    ZjVjZDRkYjE1YmNlNTU4YTIwYTYxNTMyNDFjMWQ2MGFiOTU3ZGNkNTlmZmZi
-    ZTdlOTI1M2ZhNTE1NDQzZTRiNTIzMjc2NTYxYzk3MGQ1Zjk5N2Q=
+  metadata.gz: 8f9932ab978f4cdeabc001314496ffed4214f9a966b45847e246c2c78730b1388ee1169a4def1864edb78481fbb30cefbffe29fd366f1a3abe207d107175c681
+  data.tar.gz: d42dbf95c6d38e99c1e0f356f31925ef6da59ba465a768ad5d25f573a02bb75e671330dbe6dfc4a52bf039879eab7ee53fe371d50d7e540ddaa5f87cd93aa8f6

data/.gitignore

@@ -15,3 +15,4 @@ spec/reports
 test/tmp
 test/version_tmp
 tmp
+.idea

data/README.md

@@ -1,47 +1,61 @@
+# This gem is no longer maintained!
+
+Read about [reasons and alternatives](https://makandracards.com/makandra/53693-rails-making-all-cookies-secure-to-pass-a-security-audit).
+
+
+--------------------
+
 # SafeCookies
 
-This gem has a middleware that will make all cookies secure. In detail, it will
-to two separate things:
+This gem has a middleware that will make all cookies secure, by setting the
+`HttpOnly` and the `secure` flag for all cookies the application sets on the
+client.
+
+Making a cookie `HttpOnly` prevents Javascripts from seeing it, which really
+should be the default. It makes it way harder to steal cookie information via
+malicious Javascript.
 
-1) set all new application cookies 'HttpOnly', unless specified otherwise;  
-   set all new application cookies 'secure', if the request came via HTTPS and not specified otherwise
+Making a cookie `secure` tells the browser to only send the cookie over HTTPS
+connections, protecting it from being sniffed by a man-in-the-middle. (Setting a
+[HSTS](http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) header
+achieves the same, but Safari < 7 and IE < 11 don't speak HSTS.)
+
+SafeCookies will *additionally* rewrite all cookies the user is sending. **But**
+it can only do so, if the cookie was registered before (see below). It will rewrite
+user cookies only once per user.
 
-2) rewrite request cookies, setting both flags as above
 
 ## Installation
 
-### Step 1
-Add `gem 'safe_cookies'` to your application's Gemfile, then run `bundle install`.
+1. Add `gem 'safe_cookies'` to your application's Gemfile, then run `bundle install`.
 
-### Step 2
-**Rails 3 and 4**: add the following lines to the application block in config/application.rb:
+2. Add a configuration block in an initializer (e.g. `config/initializers/safe_cookies.rb`):
 
-    require 'safe_cookies'
-    config.middleware.insert_before ActionDispatch::Cookies, SafeCookies::Middleware
+        SafeCookies.configure do |config|
+          # configuration ...
+        end
 
-**Rails 2:** add the following lines to the initializer block in config/environment.rb:
+3. Register the middleware:
 
-    require 'safe_cookies'
-    config.middleware.insert_before ActionController::Session::CookieStore, SafeCookies::Middleware
+    Rails 3+: add the following lines to the application block in `config/application.rb`:
 
+        require 'safe_cookies'
+        config.middleware.insert_before ActionDispatch::Cookies, SafeCookies::Middleware
 
-Now all your cookies will be made `secure` and `HttpOnly`. But what if you need
-a cookie to be accessible via HTTP or Javascript?
+    Rails 2: add the following lines to the initializer block in `config/environment.rb`:
 
-### Having a cookie non-secure or non-HttpOnly
-Tell the middleware which cookies not to make `secure` or `HttpOnly` by
-registering them. Do it either just after the lines you added above or in an
-initializer (e.g. in `config/initializers/safe_cookies.rb`). The `:expire_after` option is required.
+        require 'safe_cookies'
+        config.middleware.insert_before ActionController::Session::CookieStore, SafeCookies::Middleware
 
-    SafeCookies.configure do |config|
-      config.register_cookie :default_language, :expire_after => 10.years, :secure => false
-      config.register_cookie :javascript_data, :expire_after => 1.day, :http_only => false
-    end
+Now all new cookies will be made `secure` and `HttpOnly`. But what about cookies
+already out there?
+
+
+## Updating existing cookies
 
-### Employing SafeCookies in apps that are already running in production
 Unfortunately, [the client won't ever tell us](http://tools.ietf.org/html/rfc6265#section-4.2.2)
-if it stores the cookie with flags such as `secure` or which expiry date it
-currently has. Therefore, in order to make the middleware retroactively secure
+if it stores a cookie with flags such as `secure` or which expiry date it is
+stored with. Therefore, in order to make the middleware retroactively secure
 cookies owned by the client, you need to register each of those cookies with
 the middleware, specifying their properties.
 
@@ -49,47 +63,56 @@ Carefully scan your app for cookies you are using. There's no easy way to find
 out if you missed one (but see below for some help the gem provides).
 
     SafeCookies.configure do |config|
-      config.register_cookie :remember_token, :expire_after => 1.year
-      config.register_cookie :last_action, :expire_after => 30.days, :path => '/commerce'
+      config.register_cookie 'remember_token', :expire_after => 1.year
+      config.register_cookie 'last_action', :expire_after => 30.days, :path => '/commerce'
     end
 
 Available options are: `:expire_after` (required)`, :path, :secure, :http_only`.
+For cookies with "session" expiry, set `:expire_after => nil`.
 
 
-## Dealing with unknown cookies
+## Having a cookie non-secure or non-HttpOnly
+
+Tell SafeCookies which cookies not to make `secure` or `HttpOnly` by registering
+them, just like above:
+
+    SafeCookies.configure do |config|
+      config.register_cookie 'default_language', :expire_after => 10.years, :secure => false
+      config.register_cookie 'javascript_data', :expire_after => 1.day, :http_only => false
+    end
+
+
+## Finding unregistered user cookies
 
 There are lots of cookies your application receives that you never did set.
 However, if you want to know about any unknown cookies touching your
-application, SafeCookies offers two ways to achieve this.
+application, SafeCookies gives you two tools.
 
-1) If you set `config.log_unknown_cookies = true` in the configuration, all
+1) If you set `config.log_unknown_cookies = true` in the configuration block, all
 unknown cookies will be written to the Rails log. When you start implementing
 the middleware, closely watch it to find cookies you forgot to register.
 
 2) You may overwrite `SafeCookies::Middleware#handle_unknown_cookies(cookies)`
-in the config initializer for customized behaviour (like, notifying you per
+in the configuration block for customized behaviour (like, notifying you per
 email).
 
-
-## Ignoring cookies
-
-The middleware won't see request cookies that are configured to be ignored. Use this to keep your logs lean, if you are using the `log_unknown_cookies` option.
-
-You can tell the middleware to ignore cookies with the `config.ignore_cookie`
-directive, which takes either a String or a Regex parameter. Be careful when using regular expressions!
+To ignore cookies that are irrelevant to you, you may configure them to be
+ignored. Use the `config.ignore_cookie` directive, which takes either a String
+or a Regex parameter. *Be careful when using regular expressions!*
 
 
-## Fix cookie paths
+## Fixing cookie paths
 
-In August 2013 we noticed a bug in SafeCookies < 0.1.4, by which secured cookies would be set for the
-current "directory" (see comments in `cookie_path_fix.rb`) instead of root (which usually is what you want).
-Users would get multiple cookies for that domain, leading to issues like being unable to sign in.
+In August 2013 we noticed a bug in SafeCookies < 0.1.4, by which secured cookies
+would be set for the current "directory" (see comments in `cookie_path_fix.rb`)
+instead of root (which usually is what you want). Users would get multiple
+cookies for that domain, leading to issues like being unable to sign in.
 
-The configuration option `config.fix_paths` turns on fixing this error. It requires an option
-`:for_cookies_secured_before => Time.parse('some minutes after you will have deployed')` which reflects the
-point of time from which cookies will be secured with the correct path. The middleware will fix the cookie
-paths by rewriting all cookies that it has already secured, but only if they were secured before the time
-you specified.
+The configuration option `config.fix_paths` turns on fixing this error. It
+expects an option `:for_cookies_secured_before => Time.parse('some minutes after
+you will have deployed')` which reflects the point of time from which SafeCookies
+can expect cookies to be set with the correct path. It will only rewrite cookies
+with a new path if it had set them before that point of time.
 
 
 ## Development

data/lib/safe_cookies/version.rb

@@ -1,3 +1,3 @@
 module SafeCookies
-  VERSION = '0.2.1'
+  VERSION = '0.2.2'
 end

data/safe_cookies.gemspec

@@ -7,6 +7,7 @@ Gem::Specification.new do |gem|
   gem.description   = %q{Make all cookies `secure` and `HttpOnly`.}
   gem.summary       = %q{Make all cookies `secure` and `HttpOnly`.}
   gem.homepage      = "http://www.makandra.de"
+  gem.license       = "MIT"
 
   gem.files         = `git ls-files`.split($\)
   gem.executables   = gem.files.grep(%r{^bin/}).map{ |f| File.basename(f) }

metadata

@@ -1,69 +1,69 @@
 --- !ruby/object:Gem::Specification
 name: safe_cookies
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.2.2
 platform: ruby
 authors:
 - Dominik Schöler
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-11-25 00:00:00.000000000 Z
+date: 2021-04-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: timecop
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: debugger
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 description: Make all cookies `secure` and `HttpOnly`.
@@ -73,7 +73,7 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- .gitignore
+- ".gitignore"
 - Gemfile
 - LICENSE
 - README.md
@@ -91,7 +91,8 @@ files:
 - spec/spec_helper.rb
 - spec/util_spec.rb
 homepage: http://www.makandra.de
-licenses: []
+licenses:
+- MIT
 metadata: {}
 post_install_message: 
 rdoc_options: []
@@ -99,17 +100,16 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ! '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ! '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.1.2
+rubygems_version: 3.2.15
 signing_key: 
 specification_version: 4
 summary: Make all cookies `secure` and `HttpOnly`.