secure_headers 3.6.0 → 4.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (59) hide show
  1. checksums.yaml +4 -4
  2. data/.rspec +2 -0
  3. data/.rubocop.yml +3 -0
  4. data/.ruby-version +1 -1
  5. data/.travis.yml +8 -4
  6. data/CHANGELOG.md +38 -1
  7. data/CODE_OF_CONDUCT.md +46 -0
  8. data/CONTRIBUTING.md +41 -0
  9. data/Gemfile +7 -4
  10. data/Guardfile +1 -0
  11. data/LICENSE +4 -199
  12. data/README.md +18 -20
  13. data/Rakefile +22 -18
  14. data/docs/cookies.md +16 -2
  15. data/docs/hashes.md +1 -1
  16. data/docs/per_action_configuration.md +28 -0
  17. data/lib/secure_headers/configuration.rb +30 -17
  18. data/lib/secure_headers/hash_helper.rb +2 -1
  19. data/lib/secure_headers/headers/clear_site_data.rb +16 -12
  20. data/lib/secure_headers/headers/content_security_policy.rb +54 -22
  21. data/lib/secure_headers/headers/content_security_policy_config.rb +46 -12
  22. data/lib/secure_headers/headers/cookie.rb +21 -3
  23. data/lib/secure_headers/headers/expect_certificate_transparency.rb +70 -0
  24. data/lib/secure_headers/headers/policy_management.rb +122 -67
  25. data/lib/secure_headers/headers/public_key_pins.rb +5 -4
  26. data/lib/secure_headers/headers/referrer_policy.rb +2 -1
  27. data/lib/secure_headers/headers/strict_transport_security.rb +2 -1
  28. data/lib/secure_headers/headers/x_content_type_options.rb +2 -1
  29. data/lib/secure_headers/headers/x_download_options.rb +3 -2
  30. data/lib/secure_headers/headers/x_frame_options.rb +2 -1
  31. data/lib/secure_headers/headers/x_permitted_cross_domain_policies.rb +3 -2
  32. data/lib/secure_headers/headers/x_xss_protection.rb +2 -1
  33. data/lib/secure_headers/middleware.rb +10 -9
  34. data/lib/secure_headers/railtie.rb +7 -6
  35. data/lib/secure_headers/utils/cookies_config.rb +13 -12
  36. data/lib/secure_headers/view_helper.rb +4 -3
  37. data/lib/secure_headers.rb +7 -3
  38. data/lib/tasks/tasks.rake +2 -1
  39. data/secure_headers.gemspec +13 -3
  40. data/spec/lib/secure_headers/configuration_spec.rb +9 -8
  41. data/spec/lib/secure_headers/headers/clear_site_data_spec.rb +11 -27
  42. data/spec/lib/secure_headers/headers/content_security_policy_spec.rb +47 -26
  43. data/spec/lib/secure_headers/headers/cookie_spec.rb +38 -20
  44. data/spec/lib/secure_headers/headers/expect_certificate_spec.rb +42 -0
  45. data/spec/lib/secure_headers/headers/policy_management_spec.rb +57 -10
  46. data/spec/lib/secure_headers/headers/public_key_pins_spec.rb +7 -6
  47. data/spec/lib/secure_headers/headers/referrer_policy_spec.rb +4 -3
  48. data/spec/lib/secure_headers/headers/strict_transport_security_spec.rb +5 -4
  49. data/spec/lib/secure_headers/headers/x_content_type_options_spec.rb +2 -1
  50. data/spec/lib/secure_headers/headers/x_download_options_spec.rb +3 -2
  51. data/spec/lib/secure_headers/headers/x_frame_options_spec.rb +2 -1
  52. data/spec/lib/secure_headers/headers/x_permitted_cross_domain_policies_spec.rb +4 -3
  53. data/spec/lib/secure_headers/headers/x_xss_protection_spec.rb +4 -3
  54. data/spec/lib/secure_headers/middleware_spec.rb +29 -21
  55. data/spec/lib/secure_headers/view_helpers_spec.rb +5 -5
  56. data/spec/lib/secure_headers_spec.rb +106 -107
  57. data/spec/spec_helper.rb +10 -22
  58. data/upgrading-to-4-0.md +55 -0
  59. metadata +19 -7
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: secure_headers
3
3
  version: !ruby/object:Gem::Version
4
- version: 3.6.0
4
+ version: 4.0.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Neil Matatall
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2017-01-05 00:00:00.000000000 Z
11
+ date: 2017-09-18 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: rake
@@ -30,15 +30,15 @@ dependencies:
30
30
  requirements:
31
31
  - - ">="
32
32
  - !ruby/object:Gem::Version
33
- version: '0'
33
+ version: 0.15.0
34
34
  type: :runtime
35
35
  prerelease: false
36
36
  version_requirements: !ruby/object:Gem::Requirement
37
37
  requirements:
38
38
  - - ">="
39
39
  - !ruby/object:Gem::Version
40
- version: '0'
41
- description: Security related headers all in one gem.
40
+ version: 0.15.0
41
+ description: Manages application of security headers with many safe defaults.
42
42
  email:
43
43
  - neil.matatall@gmail.com
44
44
  executables: []
@@ -49,10 +49,13 @@ files:
49
49
  - ".github/PULL_REQUEST_TEMPLATE.md"
50
50
  - ".gitignore"
51
51
  - ".rspec"
52
+ - ".rubocop.yml"
52
53
  - ".ruby-gemset"
53
54
  - ".ruby-version"
54
55
  - ".travis.yml"
55
56
  - CHANGELOG.md
57
+ - CODE_OF_CONDUCT.md
58
+ - CONTRIBUTING.md
56
59
  - Gemfile
57
60
  - Guardfile
58
61
  - LICENSE
@@ -71,6 +74,7 @@ files:
71
74
  - lib/secure_headers/headers/content_security_policy.rb
72
75
  - lib/secure_headers/headers/content_security_policy_config.rb
73
76
  - lib/secure_headers/headers/cookie.rb
77
+ - lib/secure_headers/headers/expect_certificate_transparency.rb
74
78
  - lib/secure_headers/headers/policy_management.rb
75
79
  - lib/secure_headers/headers/public_key_pins.rb
76
80
  - lib/secure_headers/headers/referrer_policy.rb
@@ -90,6 +94,7 @@ files:
90
94
  - spec/lib/secure_headers/headers/clear_site_data_spec.rb
91
95
  - spec/lib/secure_headers/headers/content_security_policy_spec.rb
92
96
  - spec/lib/secure_headers/headers/cookie_spec.rb
97
+ - spec/lib/secure_headers/headers/expect_certificate_spec.rb
93
98
  - spec/lib/secure_headers/headers/policy_management_spec.rb
94
99
  - spec/lib/secure_headers/headers/public_key_pins_spec.rb
95
100
  - spec/lib/secure_headers/headers/referrer_policy_spec.rb
@@ -104,11 +109,17 @@ files:
104
109
  - spec/lib/secure_headers_spec.rb
105
110
  - spec/spec_helper.rb
106
111
  - upgrading-to-3-0.md
112
+ - upgrading-to-4-0.md
107
113
  homepage: https://github.com/twitter/secureheaders
108
114
  licenses:
109
115
  - Apache Public License 2.0
110
116
  metadata: {}
111
- post_install_message:
117
+ post_install_message: |2+
118
+
119
+ **********
120
+ :wave: secure_headers 4.0 introduces a lot of breaking changes (in the name of security!). It's highly likely you will need to update your secure_headers cookie configuration to avoid breaking things. See the upgrade guide for details: https://github.com/twitter/secureheaders/blob/master/upgrading-to-4-0.md
121
+ **********
122
+
112
123
  rdoc_options: []
113
124
  require_paths:
114
125
  - lib
@@ -124,7 +135,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
124
135
  version: '0'
125
136
  requirements: []
126
137
  rubyforge_project:
127
- rubygems_version: 2.4.5.1
138
+ rubygems_version: 2.6.11
128
139
  signing_key:
129
140
  specification_version: 4
130
141
  summary: Add easily configured security headers to responses including content-security-policy,
@@ -134,6 +145,7 @@ test_files:
134
145
  - spec/lib/secure_headers/headers/clear_site_data_spec.rb
135
146
  - spec/lib/secure_headers/headers/content_security_policy_spec.rb
136
147
  - spec/lib/secure_headers/headers/cookie_spec.rb
148
+ - spec/lib/secure_headers/headers/expect_certificate_spec.rb
137
149
  - spec/lib/secure_headers/headers/policy_management_spec.rb
138
150
  - spec/lib/secure_headers/headers/public_key_pins_spec.rb
139
151
  - spec/lib/secure_headers/headers/referrer_policy_spec.rb