secure_headers 3.2.0 → 4.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (65) hide show
  1. checksums.yaml +4 -4
  2. data/.github/ISSUE_TEMPLATE.md +41 -0
  3. data/.github/PULL_REQUEST_TEMPLATE.md +20 -0
  4. data/.rspec +2 -0
  5. data/.rubocop.yml +3 -0
  6. data/.ruby-version +1 -1
  7. data/.travis.yml +8 -4
  8. data/CHANGELOG.md +144 -1
  9. data/CODE_OF_CONDUCT.md +46 -0
  10. data/CONTRIBUTING.md +41 -0
  11. data/Gemfile +9 -4
  12. data/Guardfile +1 -0
  13. data/LICENSE +4 -199
  14. data/README.md +73 -344
  15. data/Rakefile +22 -18
  16. data/docs/HPKP.md +17 -0
  17. data/docs/cookies.md +64 -0
  18. data/docs/hashes.md +64 -0
  19. data/docs/named_overrides_and_appends.md +107 -0
  20. data/docs/per_action_configuration.md +133 -0
  21. data/docs/sinatra.md +25 -0
  22. data/lib/secure_headers/configuration.rb +116 -42
  23. data/lib/secure_headers/hash_helper.rb +2 -1
  24. data/lib/secure_headers/headers/clear_site_data.rb +55 -0
  25. data/lib/secure_headers/headers/content_security_policy.rb +128 -39
  26. data/lib/secure_headers/headers/content_security_policy_config.rb +162 -0
  27. data/lib/secure_headers/headers/cookie.rb +21 -3
  28. data/lib/secure_headers/headers/expect_certificate_transparency.rb +70 -0
  29. data/lib/secure_headers/headers/policy_management.rb +158 -68
  30. data/lib/secure_headers/headers/public_key_pins.rb +5 -4
  31. data/lib/secure_headers/headers/referrer_policy.rb +37 -0
  32. data/lib/secure_headers/headers/strict_transport_security.rb +2 -1
  33. data/lib/secure_headers/headers/x_content_type_options.rb +2 -1
  34. data/lib/secure_headers/headers/x_download_options.rb +3 -2
  35. data/lib/secure_headers/headers/x_frame_options.rb +2 -1
  36. data/lib/secure_headers/headers/x_permitted_cross_domain_policies.rb +3 -2
  37. data/lib/secure_headers/headers/x_xss_protection.rb +2 -1
  38. data/lib/secure_headers/middleware.rb +16 -9
  39. data/lib/secure_headers/railtie.rb +7 -6
  40. data/lib/secure_headers/utils/cookies_config.rb +13 -12
  41. data/lib/secure_headers/view_helper.rb +15 -8
  42. data/lib/secure_headers.rb +139 -55
  43. data/lib/tasks/tasks.rake +7 -5
  44. data/secure_headers.gemspec +13 -3
  45. data/spec/lib/secure_headers/configuration_spec.rb +13 -12
  46. data/spec/lib/secure_headers/headers/clear_site_data_spec.rb +87 -0
  47. data/spec/lib/secure_headers/headers/content_security_policy_spec.rb +89 -15
  48. data/spec/lib/secure_headers/headers/cookie_spec.rb +38 -20
  49. data/spec/lib/secure_headers/headers/expect_certificate_spec.rb +42 -0
  50. data/spec/lib/secure_headers/headers/policy_management_spec.rb +80 -42
  51. data/spec/lib/secure_headers/headers/public_key_pins_spec.rb +7 -6
  52. data/spec/lib/secure_headers/headers/referrer_policy_spec.rb +73 -0
  53. data/spec/lib/secure_headers/headers/strict_transport_security_spec.rb +5 -4
  54. data/spec/lib/secure_headers/headers/x_content_type_options_spec.rb +2 -1
  55. data/spec/lib/secure_headers/headers/x_download_options_spec.rb +3 -2
  56. data/spec/lib/secure_headers/headers/x_frame_options_spec.rb +2 -1
  57. data/spec/lib/secure_headers/headers/x_permitted_cross_domain_policies_spec.rb +4 -3
  58. data/spec/lib/secure_headers/headers/x_xss_protection_spec.rb +4 -3
  59. data/spec/lib/secure_headers/middleware_spec.rb +55 -17
  60. data/spec/lib/secure_headers/view_helpers_spec.rb +21 -8
  61. data/spec/lib/secure_headers_spec.rb +330 -58
  62. data/spec/spec_helper.rb +17 -25
  63. data/upgrading-to-3-0.md +13 -10
  64. data/upgrading-to-4-0.md +55 -0
  65. metadata +34 -7
data/upgrading-to-3-0.md CHANGED
@@ -3,16 +3,19 @@
3
3
  Changes
4
4
  ==
5
5
 
6
- | What | < = 2.x | >= 3.0 |
7
- |----------------------------------|----------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
8
- | Global configuration | `SecureHeaders::Configuration.configure` block | `SecureHeaders::Configuration.default` block |
9
- | All headers besides HPKP and CSP | Accept hashes as config values | Must be strings (validated during configuration) |
10
- | CSP directive values | Accepted space delimited strings OR arrays of strings | Must be arrays of strings |
11
- | CSP Nonce values in views | `@content_security_policy_nonce` | `content_security_policy_script_nonce` or `content_security_policy_style_nonce`
12
- | `self`/`none` source expressions | could be `self` / `none` / `'self'` / `'none'` | Must be `'self'` or `'none'` |
13
- | `inline` / `eval` source expressions | could be `inline`, `eval`, `'unsafe-inline'`, or `'unsafe-eval'` | Must be `'unsafe-eval'` or `'unsafe-inline'` |
14
- | Per-action configuration | override [`def secure_header_options_for(header, options)`](https://github.com/twitter/secureheaders/commit/bb9ebc6c12a677aad29af8e0f08ffd1def56efec#diff-04c6e90faac2675aa89e2176d2eec7d8R111) | Use [named overrides](https://github.com/twitter/secureheaders#named-overrides) or [per-action helpers](https://github.com/twitter/secureheaders#per-action-configuration) |
15
- | CSP/HPKP use `report_only` config that defaults to false | `enforce: false` | `report_only: false` |
6
+ | What | < = 2.x | >= 3.0 |
7
+ | ---------------------------------- | ---------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
8
+ | Global configuration | `SecureHeaders::Configuration.configure` block | `SecureHeaders::Configuration.default` block |
9
+ | All headers besides HPKP and CSP | Accept hashes as config values | Must be strings (validated during configuration) |
10
+ | CSP directive values | Accepted space delimited strings OR arrays of strings | Must be arrays of strings |
11
+ | CSP Nonce values in views | `@content_security_policy_nonce` | `content_security_policy_nonce(:script)` or `content_security_policy_nonce(:style)` |
12
+ | nonce is no longer a source expression | `config.csp = "'self' 'nonce'"` | Remove `'nonce'` from source expression and use [nonce helpers](https://github.com/twitter/secureheaders#nonce). |
13
+ | `self`/`none` source expressions | Could be `self` / `none` / `'self'` / `'none'` | Must be `'self'` or `'none'` |
14
+ | `inline` / `eval` source expressions | Could be `inline`, `eval`, `'unsafe-inline'`, or `'unsafe-eval'` | Must be `'unsafe-eval'` or `'unsafe-inline'` |
15
+ | Per-action configuration | Override [`def secure_header_options_for(header, options)`](https://github.com/twitter/secureheaders/commit/bb9ebc6c12a677aad29af8e0f08ffd1def56efec#diff-04c6e90faac2675aa89e2176d2eec7d8R111) | Use [named overrides](https://github.com/twitter/secureheaders#named-overrides) or [per-action helpers](https://github.com/twitter/secureheaders#per-action-configuration) |
16
+ | CSP/HPKP use `report_only` config that defaults to false | `enforce: false` | `report_only: false` |
17
+ | Schemes in source expressions | Schemes were not stripped | Schemes are stripped by default to discourage mixed content. Setting `preserve_schemes: true` will revert to previous behavior |
18
+ | Opting out of default configuration | `skip_before_filter :set_x_download_options_header` or `config.x_download_options = false` | Within default block: `config.x_download_options = SecureHeaders::OPT_OUT` |
16
19
 
17
20
  Migrating to 3.x from <= 2.x
18
21
  ==
data/upgrading-to-4-0.md ADDED
@@ -0,0 +1,55 @@
1
+ ### Breaking Changes
2
+
3
+ The most likely change to break your app is the new cookie defaults. This is the first place to check. If you're using the default CSP, your policy will change but your app should not break. This should not break brand new projects using secure_headers either.
4
+
5
+ ## All cookies default to secure/httponly/SameSite=Lax
6
+
7
+ By default, *all* cookies will be marked as `SameSite=lax`,`secure`, and `httponly`. To opt-out, supply `OPT_OUT` as the value for `SecureHeaders.cookies` or the individual configs. Setting these values to `false` will raise an error.
8
+
9
+ ```ruby
10
+ # specific opt outs
11
+ config.cookies = {
12
+ secure: OPT_OUT,
13
+ httponly: OPT_OUT,
14
+ samesite: OPT_OUT,
15
+ }
16
+
17
+ # nuclear option, just make things work again
18
+ config.cookies = OPT_OUT
19
+ ```
20
+
21
+ ## script_src must be set
22
+
23
+ Not setting a `script_src` value means your policy falls back to whatever `default_src` (also required) is set to. This can be very dangerous and indicates the policy is too loose.
24
+
25
+ However, sometimes you really don't need a `script-src` e.g. API responses (`default-src 'none'`) so you can set `script_src: SecureHeaders::OPT_OUT` to work around this.
26
+
27
+ ## Default Content Security Policy
28
+
29
+ The default CSP has changed to be more universal without sacrificing too much security.
30
+
31
+ * Flash/Java disabled by default
32
+ * `img-src` allows data: images and favicons (among others)
33
+ * `style-src` allows inline CSS by default (most find it impossible/impractical to remove inline content today)
34
+ * `form-action` (not governed by `default-src`, practically treated as `*`) is set to `'self'`
35
+
36
+ Previously, the default CSP was:
37
+
38
+ `Content-Security-Policy: default-src 'self'`
39
+
40
+ The new default policy is:
41
+
42
+ `default-src https:; form-action 'self'; img-src https: data: 'self'; object-src 'none'; script-src https:; style-src 'self' 'unsafe-inline' https:`
43
+
44
+ ## CSP configuration
45
+
46
+ * Setting `report_only: true` in a CSP config will raise an error. Instead, set `csp_report_only`.
47
+ * Setting `frame_src` and `child_src` when values don't match will raise an error. Just use `frame_src`.
48
+
49
+ ## config.secure_cookies removed
50
+
51
+ Use `config.cookies` instead.
52
+
53
+ ## Supported ruby versions
54
+
55
+ We've dropped support for ruby versions <= 2.2. Sorry.
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: secure_headers
3
3
  version: !ruby/object:Gem::Version
4
- version: 3.2.0
4
+ version: 4.0.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Neil Matatall
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2016-04-18 00:00:00.000000000 Z
11
+ date: 2017-09-18 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: rake
@@ -30,39 +30,54 @@ dependencies:
30
30
  requirements:
31
31
  - - ">="
32
32
  - !ruby/object:Gem::Version
33
- version: '0'
33
+ version: 0.15.0
34
34
  type: :runtime
35
35
  prerelease: false
36
36
  version_requirements: !ruby/object:Gem::Requirement
37
37
  requirements:
38
38
  - - ">="
39
39
  - !ruby/object:Gem::Version
40
- version: '0'
41
- description: Security related headers all in one gem.
40
+ version: 0.15.0
41
+ description: Manages application of security headers with many safe defaults.
42
42
  email:
43
43
  - neil.matatall@gmail.com
44
44
  executables: []
45
45
  extensions: []
46
46
  extra_rdoc_files: []
47
47
  files:
48
+ - ".github/ISSUE_TEMPLATE.md"
49
+ - ".github/PULL_REQUEST_TEMPLATE.md"
48
50
  - ".gitignore"
49
51
  - ".rspec"
52
+ - ".rubocop.yml"
50
53
  - ".ruby-gemset"
51
54
  - ".ruby-version"
52
55
  - ".travis.yml"
53
56
  - CHANGELOG.md
57
+ - CODE_OF_CONDUCT.md
58
+ - CONTRIBUTING.md
54
59
  - Gemfile
55
60
  - Guardfile
56
61
  - LICENSE
57
62
  - README.md
58
63
  - Rakefile
64
+ - docs/HPKP.md
65
+ - docs/cookies.md
66
+ - docs/hashes.md
67
+ - docs/named_overrides_and_appends.md
68
+ - docs/per_action_configuration.md
69
+ - docs/sinatra.md
59
70
  - lib/secure_headers.rb
60
71
  - lib/secure_headers/configuration.rb
61
72
  - lib/secure_headers/hash_helper.rb
73
+ - lib/secure_headers/headers/clear_site_data.rb
62
74
  - lib/secure_headers/headers/content_security_policy.rb
75
+ - lib/secure_headers/headers/content_security_policy_config.rb
63
76
  - lib/secure_headers/headers/cookie.rb
77
+ - lib/secure_headers/headers/expect_certificate_transparency.rb
64
78
  - lib/secure_headers/headers/policy_management.rb
65
79
  - lib/secure_headers/headers/public_key_pins.rb
80
+ - lib/secure_headers/headers/referrer_policy.rb
66
81
  - lib/secure_headers/headers/strict_transport_security.rb
67
82
  - lib/secure_headers/headers/x_content_type_options.rb
68
83
  - lib/secure_headers/headers/x_download_options.rb
@@ -76,10 +91,13 @@ files:
76
91
  - lib/tasks/tasks.rake
77
92
  - secure_headers.gemspec
78
93
  - spec/lib/secure_headers/configuration_spec.rb
94
+ - spec/lib/secure_headers/headers/clear_site_data_spec.rb
79
95
  - spec/lib/secure_headers/headers/content_security_policy_spec.rb
80
96
  - spec/lib/secure_headers/headers/cookie_spec.rb
97
+ - spec/lib/secure_headers/headers/expect_certificate_spec.rb
81
98
  - spec/lib/secure_headers/headers/policy_management_spec.rb
82
99
  - spec/lib/secure_headers/headers/public_key_pins_spec.rb
100
+ - spec/lib/secure_headers/headers/referrer_policy_spec.rb
83
101
  - spec/lib/secure_headers/headers/strict_transport_security_spec.rb
84
102
  - spec/lib/secure_headers/headers/x_content_type_options_spec.rb
85
103
  - spec/lib/secure_headers/headers/x_download_options_spec.rb
@@ -91,11 +109,17 @@ files:
91
109
  - spec/lib/secure_headers_spec.rb
92
110
  - spec/spec_helper.rb
93
111
  - upgrading-to-3-0.md
112
+ - upgrading-to-4-0.md
94
113
  homepage: https://github.com/twitter/secureheaders
95
114
  licenses:
96
115
  - Apache Public License 2.0
97
116
  metadata: {}
98
- post_install_message:
117
+ post_install_message: |2+
118
+
119
+ **********
120
+ :wave: secure_headers 4.0 introduces a lot of breaking changes (in the name of security!). It's highly likely you will need to update your secure_headers cookie configuration to avoid breaking things. See the upgrade guide for details: https://github.com/twitter/secureheaders/blob/master/upgrading-to-4-0.md
121
+ **********
122
+
99
123
  rdoc_options: []
100
124
  require_paths:
101
125
  - lib
@@ -111,17 +135,20 @@ required_rubygems_version: !ruby/object:Gem::Requirement
111
135
  version: '0'
112
136
  requirements: []
113
137
  rubyforge_project:
114
- rubygems_version: 2.4.5.1
138
+ rubygems_version: 2.6.11
115
139
  signing_key:
116
140
  specification_version: 4
117
141
  summary: Add easily configured security headers to responses including content-security-policy,
118
142
  x-frame-options, strict-transport-security, etc.
119
143
  test_files:
120
144
  - spec/lib/secure_headers/configuration_spec.rb
145
+ - spec/lib/secure_headers/headers/clear_site_data_spec.rb
121
146
  - spec/lib/secure_headers/headers/content_security_policy_spec.rb
122
147
  - spec/lib/secure_headers/headers/cookie_spec.rb
148
+ - spec/lib/secure_headers/headers/expect_certificate_spec.rb
123
149
  - spec/lib/secure_headers/headers/policy_management_spec.rb
124
150
  - spec/lib/secure_headers/headers/public_key_pins_spec.rb
151
+ - spec/lib/secure_headers/headers/referrer_policy_spec.rb
125
152
  - spec/lib/secure_headers/headers/strict_transport_security_spec.rb
126
153
  - spec/lib/secure_headers/headers/x_content_type_options_spec.rb
127
154
  - spec/lib/secure_headers/headers/x_download_options_spec.rb