secure_headers 3.0.3 → 3.2.0

data/lib/secure_headers.rb

@@ -1,4 +1,6 @@
 require "secure_headers/configuration"
+require "secure_headers/hash_helper"
+require "secure_headers/headers/cookie"
 require "secure_headers/headers/public_key_pins"
 require "secure_headers/headers/content_security_policy"
 require "secure_headers/headers/x_frame_options"
@@ -48,14 +50,12 @@ module SecureHeaders
     #    script_src: %w(another-host.com)
     def override_content_security_policy_directives(request, additions)
       config = config_for(request)
-      unless CSP.idempotent_additions?(config.csp, additions)
-        config = config.dup
-        if config.csp == OPT_OUT
-          config.csp = {}
-        end
-        config.csp.merge!(additions)
-        override_secure_headers_request_config(request, config)
+      if config.current_csp == OPT_OUT
+        config.dynamic_csp = {}
       end
+
+      config.dynamic_csp = config.current_csp.merge(additions)
+      override_secure_headers_request_config(request, config)
     end
 
     # Public: appends source values to the current configuration. If no value
@@ -66,11 +66,8 @@ module SecureHeaders
     #    script_src: %w(another-host.com)
     def append_content_security_policy_directives(request, additions)
       config = config_for(request)
-      unless CSP.idempotent_additions?(config.csp, additions)
-        config = config.dup
-        config.csp = CSP.combine_policies(config.csp, additions)
-        override_secure_headers_request_config(request, config)
-      end
+      config.dynamic_csp = CSP.combine_policies(config.current_csp, additions)
+      override_secure_headers_request_config(request, config)
     end
 
     # Public: override X-Frame-Options settings for this request.
@@ -79,16 +76,16 @@ module SecureHeaders
     #
     # Returns the current config
     def override_x_frame_options(request, value)
-      default_config = config_for(request).dup
-      default_config.x_frame_options = value
-      override_secure_headers_request_config(request, default_config)
+      config = config_for(request)
+      config.update_x_frame_options(value)
+      override_secure_headers_request_config(request, config)
     end
 
     # Public: opts out of setting a given header by creating a temporary config
     # and setting the given headers config to OPT_OUT.
     def opt_out_of_header(request, header_key)
-      config = config_for(request).dup
-      config.send("#{header_key}=", OPT_OUT)
+      config = config_for(request)
+      config.opt_out(header_key)
       override_secure_headers_request_config(request, config)
     end
 
@@ -109,14 +106,11 @@ module SecureHeaders
     # in Rack middleware.
     def header_hash_for(request)
       config = config_for(request)
-
-      headers = if cached_headers = config.cached_headers
-        use_cached_headers(cached_headers, request)
-      else
-        build_headers(config, request)
+      unless ContentSecurityPolicy.idempotent_additions?(config.csp, config.current_csp)
+        config.rebuild_csp_header_cache!(request.user_agent)
       end
 
-      headers
+      use_cached_headers(config.cached_headers, request)
     end
 
     # Public: specify which named override will be used for this request.
@@ -149,6 +143,22 @@ module SecureHeaders
       content_security_policy_nonce(request, CSP::STYLE_SRC)
     end
 
+    # Public: Retreives the config for a given header type:
+    #
+    # Checks to see if there is an override for this request, then
+    # Checks to see if a named override is used for this request, then
+    # Falls back to the global config
+    def config_for(request)
+      config = request.env[SECURE_HEADERS_CONFIG] ||
+        Configuration.get(Configuration::DEFAULT_CONFIG)
+
+      if config.frozen?
+        config.dup
+      else
+        config
+      end
+    end
+
     private
 
     # Private: gets or creates a nonce for CSP.
@@ -181,64 +191,30 @@ module SecureHeaders
       end
     end
 
-    # Private: do the heavy lifting of converting a configuration object
-    # to a hash of headers valid for this request.
-    #
-    # Returns a hash of header names / values.
-    def build_headers(config, request)
-      header_classes_for(request).each_with_object({}) do |klass, hash|
-        header_config = if config
-          config.fetch(klass::CONFIG_KEY)
-        end
-
-        header_name, value = if klass == CSP
-          make_header(klass, header_config, request.user_agent)
-        else
-          make_header(klass, header_config)
-        end
-        hash[header_name] = value if value
-      end
-    end
-
     # Private: takes a precomputed hash of headers and returns the Headers
     # customized for the request.
     #
     # Returns a hash of header names / values valid for a given request.
-    def use_cached_headers(default_headers, request)
+    def use_cached_headers(headers, request)
       header_classes_for(request).each_with_object({}) do |klass, hash|
-        if default_header = default_headers[klass::CONFIG_KEY]
+        if header = headers[klass::CONFIG_KEY]
           header_name, value = if klass == CSP
-            default_csp_header_for_ua(default_header, request)
+            csp_header_for_ua(header, request)
           else
-            default_header
+            header
           end
           hash[header_name] = value
         end
       end
     end
 
-    # Private: Retreives the config for a given header type:
-    #
-    # Checks to see if there is an override for this request, then
-    # Checks to see if a named override is used for this request, then
-    # Falls back to the global config
-    def config_for(request)
-      request.env[SECURE_HEADERS_CONFIG] ||
-        Configuration.get(Configuration::DEFAULT_CONFIG)
-    end
-
     # Private: chooses the applicable CSP header for the provided user agent.
     #
     # headers - a hash of header_config_key => [header_name, header_value]
     #
     # Returns a CSP [header, value] array
-    def default_csp_header_for_ua(headers, request)
-      family = UserAgent.parse(request.user_agent).browser
-      if CSP::VARIATIONS.key?(family)
-        headers[family]
-      else
-        headers[CSP::OTHER]
-      end
+    def csp_header_for_ua(headers, request)
+      headers[CSP.ua_to_variation(UserAgent.parse(request.user_agent))]
     end
 
     # Private: optionally build a header with a given configure

data/lib/tasks/tasks.rake

@@ -0,0 +1,81 @@
+INLINE_SCRIPT_REGEX = /(<script(\s*(?!src)([\w\-])+=([\"\'])[^\"\']+\4)*\s*>)(.*?)<\/script>/mx
+INLINE_STYLE_REGEX = /(<style[^>]*>)(.*?)<\/style>/mx
+INLINE_HASH_SCRIPT_HELPER_REGEX = /<%=\s?hashed_javascript_tag(.*?)\s+do\s?%>(.*?)<%\s*end\s*%>/mx
+INLINE_HASH_STYLE_HELPER_REGEX = /<%=\s?hashed_style_tag(.*?)\s+do\s?%>(.*?)<%\s*end\s*%>/mx
+
+namespace :secure_headers do
+  include SecureHeaders::HashHelper
+
+  def is_erb?(filename)
+    filename =~ /\.erb\Z/
+  end
+
+  def is_mustache?(filename)
+    filename =~ /\.mustache\Z/
+  end
+
+  def dynamic_content?(filename, inline_script)
+    (is_mustache?(filename) && inline_script =~ /\{\{.*\}\}/) ||
+      (is_erb?(filename) && inline_script =~ /<%.*%>/)
+  end
+
+  def find_inline_content(filename, regex, hashes)
+    file = File.read(filename)
+    file.scan(regex) do # TODO don't use gsub
+      inline_script = Regexp.last_match.captures.last
+      if dynamic_content?(filename, inline_script)
+        puts "Looks like there's some dynamic content inside of a tag :-/"
+        puts "That pretty much means the hash value will never match."
+        puts "Code: " + inline_script
+        puts "=" * 20
+      end
+
+      hashes << hash_source(inline_script)
+    end
+  end
+
+  def generate_inline_script_hashes(filename)
+    hashes = []
+
+    [INLINE_SCRIPT_REGEX, INLINE_HASH_SCRIPT_HELPER_REGEX].each do |regex|
+      find_inline_content(filename, regex, hashes)
+    end
+
+    hashes
+  end
+
+  def generate_inline_style_hashes(filename)
+    hashes = []
+
+    [INLINE_STYLE_REGEX, INLINE_HASH_STYLE_HELPER_REGEX].each do |regex|
+      find_inline_content(filename, regex, hashes)
+    end
+
+    hashes
+  end
+
+  task :generate_hashes do |t, args|
+    script_hashes = {
+      "scripts" => {},
+      "styles" => {}
+    }
+
+    Dir.glob("app/{views,templates}/**/*.{erb,mustache}") do |filename|
+      hashes = generate_inline_script_hashes(filename)
+      if hashes.any?
+        script_hashes["scripts"][filename] = hashes
+      end
+
+      hashes = generate_inline_style_hashes(filename)
+      if hashes.any?
+        script_hashes["styles"][filename] = hashes
+      end
+    end
+
+    File.open(SecureHeaders::Configuration::HASH_CONFIG_FILE, 'w') do |file|
+      file.write(script_hashes.to_yaml)
+    end
+
+    puts "Script hashes from " + script_hashes.keys.size.to_s + " files added to #{SecureHeaders::Configuration::HASH_CONFIG_FILE}"
+  end
+end

data/secure_headers.gemspec

@@ -1,7 +1,7 @@
 # -*- encoding: utf-8 -*-
 Gem::Specification.new do |gem|
   gem.name          = "secure_headers"
-  gem.version       = "3.0.3"
+  gem.version       = "3.2.0"
   gem.authors       = ["Neil Matatall"]
   gem.email         = ["neil.matatall@gmail.com"]
   gem.description   = 'Security related headers all in one gem.'

data/spec/lib/secure_headers/configuration_spec.rb

@@ -29,20 +29,26 @@ module SecureHeaders
       expect_default_values(header_hash)
     end
 
-    it "copies all config values except for the cached headers when dup" do
+    it "copies config values when duping" do
       Configuration.override(:test_override, Configuration::NOOP_CONFIGURATION) do
         # do nothing, just copy it
       end
 
       config = Configuration.get(:test_override)
       noop = Configuration.get(Configuration::NOOP_CONFIGURATION)
-      [:hsts, :x_frame_options, :x_content_type_options, :x_xss_protection,
-        :x_download_options, :x_permitted_cross_domain_policies, :hpkp, :csp].each do |key|
-
+      [:csp, :dynamic_csp, :cookies].each do |key|
         expect(config.send(key)).to eq(noop.send(key)), "Value not copied: #{key}."
       end
     end
 
+    it "regenerates cached headers when building an override" do
+      Configuration.override(:test_override) do |config|
+        config.x_content_type_options = OPT_OUT
+      end
+
+      expect(Configuration.get.cached_headers).to_not eq(Configuration.get(:test_override).cached_headers)
+    end
+
     it "stores an override of the global config" do
       Configuration.override(:test_override) do |config|
         config.x_frame_options = "DENY"
@@ -76,5 +82,13 @@ module SecureHeaders
       override_config = Configuration.get(:second_override)
       expect(override_config.csp).to eq(default_src: %w('self'), script_src: %w(example.org))
     end
+
+    it "deprecates the secure_cookies configuration" do
+      expect(Kernel).to receive(:warn).with(/\[DEPRECATION\]/)
+
+      Configuration.default do |config|
+        config.secure_cookies = true
+      end
+    end
   end
 end

data/spec/lib/secure_headers/headers/content_security_policy_spec.rb

@@ -22,181 +22,6 @@ module SecureHeaders
       end
     end
 
-    describe "#validate_config!" do
-      it "accepts all keys" do
-        # (pulled from README)
-        config = {
-          # "meta" values. these will shaped the header, but the values are not included in the header.
-          report_only:  true,     # default: false
-          preserve_schemes: true, # default: false. Schemes are removed from host sources to save bytes and discourage mixed content.
-
-          # directive values: these values will directly translate into source directives
-          default_src: %w(https: 'self'),
-          frame_src: %w('self' *.twimg.com itunes.apple.com),
-          connect_src: %w(wws:),
-          font_src: %w('self' data:),
-          img_src: %w(mycdn.com data:),
-          media_src: %w(utoob.com),
-          object_src: %w('self'),
-          script_src: %w('self'),
-          style_src: %w('unsafe-inline'),
-          base_uri: %w('self'),
-          child_src: %w('self'),
-          form_action: %w('self' github.com),
-          frame_ancestors: %w('none'),
-          plugin_types: %w(application/x-shockwave-flash),
-          block_all_mixed_content: true, # see [http://www.w3.org/TR/mixed-content/](http://www.w3.org/TR/mixed-content/)
-          upgrade_insecure_requests: true, # see https://www.w3.org/TR/upgrade-insecure-requests/
-          report_uri: %w(https://example.com/uri-directive)
-        }
-
-        CSP.validate_config!(config)
-      end
-
-      it "requires a :default_src value" do
-        expect do
-          CSP.validate_config!(script_src: %('self'))
-        end.to raise_error(ContentSecurityPolicyConfigError)
-      end
-
-      it "requires :report_only to be a truthy value" do
-        expect do
-          CSP.validate_config!(default_opts.merge(report_only: "steve"))
-        end.to raise_error(ContentSecurityPolicyConfigError)
-      end
-
-      it "requires :preserve_schemes to be a truthy value" do
-        expect do
-          CSP.validate_config!(default_opts.merge(preserve_schemes: "steve"))
-        end.to raise_error(ContentSecurityPolicyConfigError)
-      end
-
-      it "requires :block_all_mixed_content to be a boolean value" do
-        expect do
-          CSP.validate_config!(default_opts.merge(block_all_mixed_content: "steve"))
-        end.to raise_error(ContentSecurityPolicyConfigError)
-      end
-
-      it "requires :upgrade_insecure_requests to be a boolean value" do
-        expect do
-          CSP.validate_config!(default_opts.merge(upgrade_insecure_requests: "steve"))
-        end.to raise_error(ContentSecurityPolicyConfigError)
-      end
-
-      it "requires all source lists to be an array of strings" do
-        expect do
-          CSP.validate_config!(default_src: "steve")
-        end.to raise_error(ContentSecurityPolicyConfigError)
-      end
-
-      it "allows nil values" do
-        expect do
-          CSP.validate_config!(default_src: %w('self'), script_src: ["https:", nil])
-        end.to_not raise_error
-      end
-
-      it "rejects unknown directives / config" do
-        expect do
-          CSP.validate_config!(default_src: %w('self'), default_src_totally_mispelled: "steve")
-        end.to raise_error(ContentSecurityPolicyConfigError)
-      end
-
-      # this is mostly to ensure people don't use the antiquated shorthands common in other configs
-      it "performs light validation on source lists" do
-        expect do
-          CSP.validate_config!(default_src: %w(self none inline eval))
-        end.to raise_error(ContentSecurityPolicyConfigError)
-      end
-    end
-
-    describe "#combine_policies" do
-      it "combines the default-src value with the override if the directive was unconfigured" do
-        combined_config = CSP.combine_policies(Configuration.default.csp, script_src: %w(anothercdn.com))
-        csp = ContentSecurityPolicy.new(combined_config)
-        expect(csp.name).to eq(CSP::HEADER_NAME)
-        expect(csp.value).to eq("default-src https:; script-src https: anothercdn.com")
-      end
-
-      it "combines directives where the original value is nil and the hash is frozen" do
-        Configuration.default do |config|
-          config.csp = {
-            default_src: %w('self'),
-            report_only: false
-          }.freeze
-        end
-        report_uri = "https://report-uri.io/asdf"
-        combined_config = CSP.combine_policies(Configuration.get.csp, report_uri: [report_uri])
-        csp = ContentSecurityPolicy.new(combined_config, USER_AGENTS[:firefox])
-        expect(csp.value).to include("report-uri #{report_uri}")
-      end
-
-      it "does not combine the default-src value for directives that don't fall back to default sources" do
-        Configuration.default do |config|
-          config.csp = {
-            default_src: %w('self'),
-            report_only: false
-          }.freeze
-        end
-        non_default_source_additions = CSP::NON_DEFAULT_SOURCES.each_with_object({}) do |directive, hash|
-          hash[directive] = %w("http://example.org)
-        end
-        combined_config = CSP.combine_policies(Configuration.get.csp, non_default_source_additions)
-
-        CSP::NON_DEFAULT_SOURCES.each do |directive|
-          expect(combined_config[directive]).to eq(%w("http://example.org))
-        end
-
-         ContentSecurityPolicy.new(combined_config, USER_AGENTS[:firefox]).value
-      end
-
-      it "overrides the report_only flag" do
-        Configuration.default do |config|
-          config.csp = {
-            default_src: %w('self'),
-            report_only: false
-          }
-        end
-        combined_config = CSP.combine_policies(Configuration.get.csp, report_only: true)
-        csp = ContentSecurityPolicy.new(combined_config, USER_AGENTS[:firefox])
-        expect(csp.name).to eq(CSP::REPORT_ONLY)
-      end
-
-      it "overrides the :block_all_mixed_content flag" do
-        Configuration.default do |config|
-          config.csp = {
-            default_src: %w(https:),
-            block_all_mixed_content: false
-          }
-        end
-        combined_config = CSP.combine_policies(Configuration.get.csp, block_all_mixed_content: true)
-        csp = ContentSecurityPolicy.new(combined_config)
-        expect(csp.value).to eq("default-src https:; block-all-mixed-content")
-      end
-
-      it "raises an error if appending to a OPT_OUT policy" do
-        Configuration.default do |config|
-          config.csp = OPT_OUT
-        end
-        expect do
-          CSP.combine_policies(Configuration.get.csp, script_src: %w(anothercdn.com))
-        end.to raise_error(ContentSecurityPolicyConfigError)
-      end
-    end
-
-    describe "#idempotent_additions?" do
-      specify { expect(ContentSecurityPolicy.idempotent_additions?(OPT_OUT, script_src: %w(b.com))).to be false }
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, script_src: %w(c.com))).to be false }
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, style_src: %w(b.com))).to be false }
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, script_src: %w(a.com b.com c.com))).to be false }
-
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, script_src: %w(b.com))).to be true }
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, script_src: %w(b.com a.com))).to be true }
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, script_src: %w())).to be true }
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, script_src: [nil])).to be true }
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, style_src: [nil])).to be true }
-      specify { expect(ContentSecurityPolicy.idempotent_additions?({script_src: %w(a.com b.com)}, style_src: nil)).to be true }
-    end
-
     describe "#value" do
       it "discards 'none' values if any other source expressions are present" do
         csp = ContentSecurityPolicy.new(default_opts.merge(frame_src: %w('self' 'none')))

data/spec/lib/secure_headers/headers/cookie_spec.rb

@@ -0,0 +1,164 @@
+require 'spec_helper'
+
+module SecureHeaders
+  describe Cookie do
+    let(:raw_cookie) { "_session=thisisatest" }
+
+    it "does not tamper with cookies when unconfigured" do
+      cookie = Cookie.new(raw_cookie, {})
+      expect(cookie.to_s).to eq(raw_cookie)
+    end
+
+    it "preserves existing attributes" do
+      cookie = Cookie.new("_session=thisisatest; secure", secure: true)
+      expect(cookie.to_s).to eq("_session=thisisatest; secure")
+    end
+
+    it "prevents duplicate flagging of attributes" do
+      cookie = Cookie.new("_session=thisisatest; secure", secure: true)
+      expect(cookie.to_s.scan(/secure/i).count).to eq(1)
+    end
+
+    context "Secure cookies" do
+      context "when configured with a boolean" do
+        it "flags cookies as Secure" do
+          cookie = Cookie.new(raw_cookie, secure: true)
+          expect(cookie.to_s).to eq("_session=thisisatest; secure")
+        end
+      end
+
+      context "when configured with a Hash" do
+        it "flags cookies as Secure when whitelisted" do
+          cookie = Cookie.new(raw_cookie, secure: { only: ["_session"]})
+          expect(cookie.to_s).to eq("_session=thisisatest; secure")
+        end
+
+        it "does not flag cookies as Secure when excluded" do
+          cookie = Cookie.new(raw_cookie, secure: { except: ["_session"] })
+          expect(cookie.to_s).to eq("_session=thisisatest")
+        end
+      end
+    end
+
+    context "HttpOnly cookies" do
+      context "when configured with a boolean" do
+        it "flags cookies as HttpOnly" do
+          cookie = Cookie.new(raw_cookie, httponly: true)
+          expect(cookie.to_s).to eq("_session=thisisatest; HttpOnly")
+        end
+      end
+
+      context "when configured with a Hash" do
+        it "flags cookies as HttpOnly when whitelisted" do
+          cookie = Cookie.new(raw_cookie, httponly: { only: ["_session"]})
+          expect(cookie.to_s).to eq("_session=thisisatest; HttpOnly")
+        end
+
+        it "does not flag cookies as HttpOnly when excluded" do
+          cookie = Cookie.new(raw_cookie, httponly: { except: ["_session"] })
+          expect(cookie.to_s).to eq("_session=thisisatest")
+        end
+      end
+    end
+
+    context "SameSite cookies" do
+      it "flags SameSite=Lax" do
+        cookie = Cookie.new(raw_cookie, samesite: { lax: { only: ["_session"] } })
+        expect(cookie.to_s).to eq("_session=thisisatest; SameSite=Lax")
+      end
+
+      it "flags SameSite=Lax when configured with a boolean" do
+        cookie = Cookie.new(raw_cookie, samesite: { lax: true})
+        expect(cookie.to_s).to eq("_session=thisisatest; SameSite=Lax")
+      end
+
+      it "does not flag cookies as SameSite=Lax when excluded" do
+        cookie = Cookie.new(raw_cookie, samesite: { lax: { except: ["_session"] } })
+        expect(cookie.to_s).to eq("_session=thisisatest")
+      end
+
+      it "flags SameSite=Strict" do
+        cookie = Cookie.new(raw_cookie, samesite: { strict: { only: ["_session"] } })
+        expect(cookie.to_s).to eq("_session=thisisatest; SameSite=Strict")
+      end
+
+      it "does not flag cookies as SameSite=Strict when excluded" do
+        cookie = Cookie.new(raw_cookie, samesite: { strict: { except: ["_session"] } })
+        expect(cookie.to_s).to eq("_session=thisisatest")
+      end
+
+      it "flags SameSite=Strict when configured with a boolean" do
+        cookie = Cookie.new(raw_cookie, samesite: { strict: true})
+        expect(cookie.to_s).to eq("_session=thisisatest; SameSite=Strict")
+      end
+
+      it "flags properly when both lax and strict are configured" do
+        raw_cookie = "_session=thisisatest"
+        cookie = Cookie.new(raw_cookie, samesite: { strict: { only: ["_session"] }, lax: { only: ["_additional_session"] } })
+        expect(cookie.to_s).to eq("_session=thisisatest; SameSite=Strict")
+      end
+
+      it "ignores configuration if the cookie is already flagged" do
+        raw_cookie = "_session=thisisatest; SameSite=Strict"
+        cookie = Cookie.new(raw_cookie, samesite: { lax: true })
+        expect(cookie.to_s).to eq(raw_cookie)
+      end
+    end
+  end
+
+  context "with an invalid configuration" do
+    it "raises an exception when not configured with a Hash" do
+      expect do
+        Cookie.validate_config!("configuration")
+      end.to raise_error(CookiesConfigError)
+    end
+
+    it "raises an exception when configured without a boolean/Hash" do
+      expect do
+        Cookie.validate_config!(secure: "true")
+      end.to raise_error(CookiesConfigError)
+    end
+
+    it "raises an exception when both only and except filters are provided" do
+      expect do
+        Cookie.validate_config!(secure: { only: [], except: [] })
+      end.to raise_error(CookiesConfigError)
+    end
+
+    it "raises an exception when SameSite is not configured with a Hash" do
+      expect do
+        Cookie.validate_config!(samesite: true)
+      end.to raise_error(CookiesConfigError)
+    end
+
+    it "raises an exception when SameSite lax and strict enforcement modes are configured with booleans" do
+      expect do
+        Cookie.validate_config!(samesite: { lax: true, strict: true})
+      end.to raise_error(CookiesConfigError)
+    end
+
+    it "raises an exception when SameSite lax and strict enforcement modes are configured with booleans" do
+      expect do
+        Cookie.validate_config!(samesite: { lax: true, strict: { only: ["_anything"] } })
+      end.to raise_error(CookiesConfigError)
+    end
+
+    it "raises an exception when both only and except filters are provided to SameSite configurations" do
+      expect do
+        Cookie.validate_config!(samesite: { lax: { only: ["_anything"], except: ["_anythingelse"] } })
+      end.to raise_error(CookiesConfigError)
+    end
+
+    it "raises an exception when both lax and strict only filters are provided to SameSite configurations" do
+      expect do
+        Cookie.validate_config!(samesite: { lax: { only: ["_anything"] }, strict: { only: ["_anything"] } })
+      end.to raise_error(CookiesConfigError)
+    end
+
+    it "raises an exception when both lax and strict only filters are provided to SameSite configurations" do
+      expect do
+        Cookie.validate_config!(samesite: { lax: { except: ["_anything"] }, strict: { except: ["_anything"] } })
+      end.to raise_error(CookiesConfigError)
+    end
+  end
+end