secure_headers 3.7.0 → 4.0.0

data/upgrading-to-4-0.md

@@ -0,0 +1,55 @@
+### Breaking Changes
+
+The most likely change to break your app is the new cookie defaults. This is the first place to check. If you're using the default CSP, your policy will change but your app should not break. This should not break brand new projects using secure_headers either.
+
+## All cookies default to secure/httponly/SameSite=Lax
+
+By default, *all* cookies will be marked as `SameSite=lax`,`secure`, and `httponly`. To opt-out, supply `OPT_OUT` as the value for `SecureHeaders.cookies` or the individual configs. Setting these values to `false` will raise an error.
+
+```ruby
+# specific opt outs
+config.cookies = {
+  secure: OPT_OUT,
+  httponly: OPT_OUT,
+  samesite: OPT_OUT,
+}
+
+# nuclear option, just make things work again
+config.cookies = OPT_OUT
+```
+
+## script_src must be set
+
+Not setting a `script_src` value means your policy falls back to whatever `default_src` (also required) is set to. This can be very dangerous and indicates the policy is too loose. 
+
+However, sometimes you really don't need a `script-src` e.g. API responses (`default-src 'none'`) so you can set `script_src: SecureHeaders::OPT_OUT` to work around this.
+
+## Default Content Security Policy
+
+The default CSP has changed to be more universal without sacrificing too much security.
+
+* Flash/Java disabled by default
+* `img-src` allows data: images and favicons (among others)
+* `style-src` allows inline CSS by default (most find it impossible/impractical to remove inline content today)
+* `form-action` (not governed by `default-src`, practically treated as `*`) is set to `'self'`
+
+Previously, the default CSP was:
+
+`Content-Security-Policy: default-src 'self'`
+
+The new default policy is:
+
+`default-src https:; form-action 'self'; img-src https: data: 'self'; object-src 'none'; script-src https:; style-src 'self' 'unsafe-inline' https:`
+
+## CSP configuration
+
+* Setting `report_only: true` in a CSP config will raise an error. Instead, set `csp_report_only`.
+* Setting `frame_src` and `child_src` when values don't match will raise an error. Just use `frame_src`.
+
+## config.secure_cookies removed
+
+Use `config.cookies` instead.
+
+## Supported ruby versions
+
+We've dropped support for ruby versions <= 2.2. Sorry.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 3.7.0
+  version: 4.0.0
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-08-25 00:00:00.000000000 Z
+date: 2017-09-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -30,14 +30,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.15.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.15.0
 description: Manages application of security headers with many safe defaults.
 email:
 - neil.matatall@gmail.com
@@ -49,6 +49,7 @@ files:
 - ".github/PULL_REQUEST_TEMPLATE.md"
 - ".gitignore"
 - ".rspec"
+- ".rubocop.yml"
 - ".ruby-gemset"
 - ".ruby-version"
 - ".travis.yml"
@@ -108,11 +109,17 @@ files:
 - spec/lib/secure_headers_spec.rb
 - spec/spec_helper.rb
 - upgrading-to-3-0.md
+- upgrading-to-4-0.md
 homepage: https://github.com/twitter/secureheaders
 licenses:
 - Apache Public License 2.0
 metadata: {}
-post_install_message: 
+post_install_message: |2+
+
+  **********
+  :wave: secure_headers 4.0 introduces a lot of breaking changes (in the name of security!). It's highly likely you will need to update your secure_headers cookie configuration to avoid breaking things. See the upgrade guide for details: https://github.com/twitter/secureheaders/blob/master/upgrading-to-4-0.md
+  **********
+
 rdoc_options: []
 require_paths:
 - lib
@@ -128,7 +135,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.5.2
+rubygems_version: 2.6.11
 signing_key: 
 specification_version: 4
 summary: Add easily configured security headers to responses including content-security-policy,