secure_escrow 0.0.6 → 0.0.7

data/lib/secure_escrow/middleware.rb

@@ -21,8 +21,12 @@ module SecureEscrow
     BAD_NONCE        = 'Bad nonce'
     DATA_KEY         = 'secure_escrow'
     REDIRECT_CODES   = 300..399
-    HTTPS            = 'HTTPS'
-    ON               = 'on'
+
+    HTTPS                   = 'HTTPS'
+    LCASE_HTTPS             = 'https'
+    ON                      = 'on'
+    HTTP_X_FORWARDED_PROTO  = 'HTTP_X_FORWARDED_PROTO'
+    RACK_URL_SCHEME         = 'rack.url_scheme'
   end
 
   class Middleware
@@ -79,7 +83,7 @@ module SecureEscrow
       end
 
       def store_response_in_escrow?
-        return false unless POST == env[REQUEST_METHOD] && ON == env[HTTPS]
+        return false unless POST == env[REQUEST_METHOD] && https?
         recognized = recognize_path
         config[:allow_non_escrow_routes] ?
           recognized :
@@ -204,6 +208,14 @@ module SecureEscrow
       end
 
       private
+      def https?
+        # Fixed in rack >= 1.3
+        return true if env[HTTPS] == ON
+        return true if LCASE_HTTPS == env[HTTP_X_FORWARDED_PROTO]
+        return true if env[HTTP_X_FORWARDED_PROTO] && LCASE_HTTPS == env[HTTP_X_FORWARDED_PROTO].split(',')[0]
+        return true if LCASE_HTTPS == env[RACK_URL_SCHEME]
+      end
+
       def rails_config
         @rails_config ||= rails_app.config.secure_escrow
       end

data/lib/secure_escrow/version.rb

@@ -1,3 +1,3 @@
 module SecureEscrow
-  VERSION = "0.0.6"
+  VERSION = "0.0.7"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: secure_escrow
 version: !ruby/object:Gem::Version
-  version: 0.0.6
+  version: 0.0.7
   prerelease: 
 platform: ruby
 authors:
@@ -13,7 +13,7 @@ date: 2012-02-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
-  requirement: &70227384088900 !ruby/object:Gem::Requirement
+  requirement: &70339795526920 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -21,7 +21,7 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70227384088900
+  version_requirements: *70339795526920
 description: SecureEscrow provides a content proxy for Rails applications allowing
   POSTing to secure actions from insecure domains without full-page refreshes
 email: