safe_cookies 0.1.0 → 0.1.1

data/lib/safe_cookies/version.rb

@@ -1,3 +1,3 @@
 module SafeCookies
-  VERSION = "0.1.0"
+  VERSION = "0.1.1"
 end

data/lib/safe_cookies.rb

@@ -100,7 +100,7 @@ module SafeCookies
         # It contains more information than the "HTTP_COOKIE" header from the
         # browser's request contained, so a `Rack::Request` can't parse it for
         # us. A `Rack::Response` doesn't offer a way either.
-        headers['Set-Cookie'] = cookies.join(",") # cookies are comma-separated
+        headers['Set-Cookie'] = cookies.join("\n")
       end
     end
     

data/spec/safe_cookies_spec.rb

@@ -0,0 +1,113 @@
+# -*- encoding: utf-8 -*-
+require 'spec_helper'
+
+# Explanation:
+# app#call(env) is how the middleware calls the app
+#   returns the app's response
+# subject#call(env) is how the middleware is called "from below"
+#   returns the response that is passed through the web server to the client
+
+describe SafeCookies::Middleware do
+  
+  let(:app) { stub 'application' }
+  let(:env) { { 'HTTPS' => 'on' } }
+  subject { described_class.new(app) }
+ 
+  it 'should rewrite specified existing cookies as "secure" and "HttpOnly", but only once' do
+    Timecop.freeze do
+      # first request: rewrite cookie
+      subject = described_class.new(app, :foo => 24 * 60 * 60)
+      app.should_receive(:call).and_return([ stub, {}, stub ])
+      env['HTTP_COOKIE'] = 'foo=bar'
+    
+      code, headers, response = subject.call(env)
+      expected_expiry = Rack::Utils.rfc2822((Time.now + 24 * 60 * 60).gmtime) # a special date format needed here
+      headers['Set-Cookie'].should =~ /foo=bar;[^\n]* HttpOnly/
+      headers['Set-Cookie'].should =~ /foo=bar;[^\n]* secure/
+      headers['Set-Cookie'].should =~ /expires=#{expected_expiry}/
+      headers['Set-Cookie'].should =~ /secured_old_cookies=/ # the indication cookie
+      
+      # second request: do not rewrite cookie again
+      subject = described_class.new(app, :foo => 24 * 60 * 60)
+      app.should_receive(:call).and_return([ stub, {}, stub ])
+      received_cookies = headers['Set-Cookie'].scan(/[^,;]+=[^,;]+(?=;\s)/i) # extract cookies
+      env['HTTP_COOKIE'] = received_cookies.join(',')
+
+      code, headers, response = subject.call(env)
+      headers['Set-Cookie'].to_s.should == ""
+    end
+  end
+  
+  it "should make new cookies secure" do
+    app.should_receive(:call).and_return([ stub, { 'Set-Cookie' => 'neuer_cookie=neuer_cookie_wert'}, stub ])
+    
+    code, headers, response = subject.call(env)
+    headers['Set-Cookie'].should =~ /neuer_cookie=neuer_cookie_wert;[^\n]* secure/
+  end
+  
+  it "should make new cookies http_only" do
+    app.should_receive(:call).and_return([ stub, { 'Set-Cookie' => 'neuer_cookie=neuer_cookie_wert'}, stub ])
+    
+    code, headers, response = subject.call(env)
+    headers['Set-Cookie'].should =~ /neuer_cookie=neuer_cookie_wert;[^\n]* HttpOnly/
+  end
+  
+  it "should not make new cookies secure that are specified as 'non_secure'" do
+    subject = described_class.new(app, :non_secure => %w[filter-settings])
+    app.should_receive(:call).and_return([ stub, { 'Set-Cookie' => 'filter-settings=sort_by_date'}, stub ])
+    
+    code, headers, response = subject.call(env)
+    headers['Set-Cookie'].should include("filter-settings=sort_by_date")
+    headers['Set-Cookie'].should_not match(/secure/i)
+  end
+  
+  it "should not make new cookies http_only that are specified as 'non_http_only'" do
+    subject = described_class.new(app, :non_http_only => %w[javascript-cookie])
+    app.should_receive(:call).and_return([ stub, { 'Set-Cookie' => 'javascript-cookie=xss'}, stub ])
+    
+    code, headers, response = subject.call(env)
+    headers['Set-Cookie'].should include("javascript-cookie=xss")
+    headers['Set-Cookie'].should_not match(/HttpOnly/i)
+  end
+  
+  it "should prefer the application's cookie if both client and app are sending one" do
+    app.should_receive(:call).and_return([ stub, { 'Set-Cookie' => 'cookie=überschrieben'}, stub ])
+    env['HTTP_COOKIE'] = 'cookie=wert'
+    
+    code, headers, response = subject.call(env)
+    headers['Set-Cookie'].should include("cookie=überschrieben")
+  end
+
+  it "should not make existing cookies secure that are specified as 'non_secure'" do
+    subject = described_class.new(app, :filter => 24 * 60 * 60, :non_secure => %w[filter])
+    app.should_receive(:call).and_return([ stub, {}, stub ])
+    env['HTTP_COOKIE'] = 'filter=cars_only'
+    
+    code, headers, response = subject.call(env)
+    set_cookie = headers['Set-Cookie'].gsub(/,(?=\s\d)/, '') # remove commas in expiry dates to simplify matching below
+    set_cookie.should =~ /filter=cars_only;[^,]* HttpOnly/
+    set_cookie.should_not match(/filter=cars_only;[^,]* secure/)
+  end
+  
+  it "should not make existing cookies http_only that are specified as 'non_http_only'" do
+    subject = described_class.new(app, :js_data => 24 * 60 * 60, :non_http_only => %w[js_data])
+    app.should_receive(:call).and_return([ stub, {}, stub ])
+    env['HTTP_COOKIE'] = 'js_data=json'
+    
+    code, headers, response = subject.call(env)
+    set_cookie = headers['Set-Cookie'].gsub(/,(?=\s\d)/, '') # remove commas in expiry dates to simplify matching below
+    set_cookie.should =~ /js_data=json;[^,]* secure/
+    set_cookie.should_not match(/js_data=json;[^,]* HttpOnly/)
+  end
+  
+  it "should not make cookies secure if the request was not secure" do
+    subject = described_class.new(app)
+    app.should_receive(:call).and_return([ stub, { 'Set-Cookie' => 'filter-settings=sort_by_date'}, stub ])
+    env['HTTPS'] = 'off'
+    
+    code, headers, response = subject.call(env)
+    headers['Set-Cookie'].should include("filter-settings=sort_by_date")
+    headers['Set-Cookie'].should_not match(/secure/i)
+  end
+
+end

data/spec/spec_helper.rb

@@ -0,0 +1,14 @@
+require File.expand_path('../../lib/safe_cookies', __FILE__)
+require 'timecop'
+
+RSpec.configure do |config|
+  config.treat_symbols_as_metadata_keys_with_true_values = true
+  config.run_all_when_everything_filtered = true
+  config.filter_run :focus
+
+  # Run specs in random order to surface order dependencies. If you find an
+  # order dependency and want to debug it, you can fix the order by providing
+  # the seed, which is printed after each run.
+  #     --seed 1234
+  config.order = 'random'
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: safe_cookies
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-06-21 00:00:00.000000000 Z
+date: 2013-06-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -74,6 +74,8 @@ files:
 - lib/safe_cookies.rb
 - lib/safe_cookies/version.rb
 - safe_cookies.gemspec
+- spec/safe_cookies_spec.rb
+- spec/spec_helper.rb
 homepage: http://www.makandra.de
 licenses: []
 post_install_message: 
@@ -98,4 +100,6 @@ rubygems_version: 1.8.24
 signing_key: 
 specification_version: 3
 summary: Make cookies as `secure` and `HttpOnly` as possible.
-test_files: []
+test_files:
+- spec/safe_cookies_spec.rb
+- spec/spec_helper.rb