secure_headers 4.0.0.alpha04 → 4.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 96b8466fa2b4e4400b0c587bdba7abebdac251f7
-  data.tar.gz: f721a9682de31fc461dd713e153cba427f846b51
+  metadata.gz: de4e0f18558ac4a65a9983f56e4dd65ca95e5f82
+  data.tar.gz: 3c16a5bdeec36aab812bcbfbbdba544b969c3a33
 SHA512:
-  metadata.gz: 29125ef959986803eff014bfd101972752272c97a5170356961dde54b78c4bcafdb5dc6fc55f99cd49f46b5c29c247e63161da9af6932fdb136d690f1dc2a598
-  data.tar.gz: b23ef45067291c21c66b735ebe19c454e8b35b5d829324ea35e33a4cb8018fad7e2a53081508334d9483bb7ff86cd9ce90b053f1c4b9052bad8c0d991d9d7f6e
+  metadata.gz: 14f3bc42066b1b4bd6044b75a78818a6ce6edc60760e84af03d13623758a4d05b9397d0c4b4baa92c71d105e0334fa39ec56124c3014e8a63096236f9c6e6d51
+  data.tar.gz: f07cfc4d11b24a7d7ec1ad50b2fb756fd3a69c8558b922eb79daf35bbf5dc721c24ca27dfa8b5ca13865dc3345cb0162161f3c41fa04ffbff8c190908d8a7b32

data/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 - See the [upgrading to 4.0](upgrading-to-4-0.md) guide. Lots of breaking changes.
 
+## 3.7.1
+
+Fix support for the sandbox attribute of CSP. `true` and `[]` represent the maximally restricted policy (`sandbox;`) and validate other values.
+
+## 3.7.0
+
+Adds support for the `Expect-CT` header (@jacobbednarz: https://github.com/twitter/secureheaders/pull/322)
+
+## 3.6.7
+
+Actually set manifest-src when configured. https://github.com/twitter/secureheaders/pull/339 Thanks @carlosantoniodasilva!
+
 ## 3.6.5
 
 Update clear-site-data header to use current format specified by the specification.

data/README.md

@@ -55,6 +55,8 @@ If you do not supply a `default` configuration, exceptions will be raised. If yo
 
 All `nil` values will fallback to their default values. `SecureHeaders::OPT_OUT` will disable the header entirely.
 
+**Word of caution:**  The following is not a default configuration per se. It serves as a sample implementation of the configuration. You should read more about these headers and determine what is appropriate for your requirements. 
+
 ```ruby
 SecureHeaders::Configuration.default do |config|
   config.cookies = {

data/docs/per_action_configuration.md

@@ -103,3 +103,31 @@ Content-Security-Policy: ...
   console.log("won't execute, not whitelisted")
 </script>
 ```
+
+## Clearing browser cache
+
+You can clear the browser cache after the logout request by using the following.
+
+``` ruby
+class ApplicationController < ActionController::Base
+  # Configuration override to send the Clear-Site-Data header.
+  SecureHeaders::Configuration.override(:clear_browser_cache) do |config|
+    config.clear_site_data = [
+      SecureHeaders::ClearSiteData::ALL_TYPES
+    ]
+  end
+
+
+  # Clears the browser's cache for browsers supporting the Clear-Site-Data
+  # header.
+  #
+  # Returns nothing.
+  def clear_browser_cache
+    SecureHeaders.use_secure_headers_override(request, :clear_browser_cache)
+  end
+end
+
+class SessionsController < ApplicationController
+  after_action  :clear_browser_cache, only: :destroy
+end
+```

data/lib/secure_headers/headers/clear_site_data.rb

@@ -8,8 +8,8 @@ module SecureHeaders
     CACHE = "cache".freeze
     COOKIES = "cookies".freeze
     STORAGE = "storage".freeze
-    EXECTION_CONTEXTS = "executionContexts".freeze
-    ALL_TYPES = [CACHE, COOKIES, STORAGE, EXECTION_CONTEXTS]
+    EXECUTION_CONTEXTS = "executionContexts".freeze
+    ALL_TYPES = [CACHE, COOKIES, STORAGE, EXECUTION_CONTEXTS]
 
     CONFIG_KEY = :clear_site_data
 

data/secure_headers.gemspec

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 Gem::Specification.new do |gem|
   gem.name          = "secure_headers"
-  gem.version       = "4.0.0.alpha04"
+  gem.version       = "4.0.0"
   gem.authors       = ["Neil Matatall"]
   gem.email         = ["neil.matatall@gmail.com"]
   gem.description   = "Manages application of security headers with many safe defaults."

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 4.0.0.alpha04
+  version: 4.0.0
 platform: ruby
 authors:
 - Neil Matatall
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-09-05 00:00:00.000000000 Z
+date: 2017-09-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -130,9 +130,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">"
+  - - ">="
     - !ruby/object:Gem::Version
-      version: 1.3.1
+      version: '0'
 requirements: []
 rubyforge_project: 
 rubygems_version: 2.6.11