secure_headers 4.0.0.alpha02 → 4.0.0.alpha03

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: c3e3971d0169ad3db917dbf0d64e26425c9e8252
-  data.tar.gz: 6fa1f1c7b0d36063a4be0a19549ced444d6f07b7
+  metadata.gz: 85aab6315aa227ca4e8e7814e1044fc43f4d0d3d
+  data.tar.gz: 6cbb3f6f3fec29168f3213d794babc76143c3201
 SHA512:
-  metadata.gz: d7f430815d9b49f0fdaf5c16854aab22d89f09721975a332769c9e0a2b055522a271a610fc8e8ec89614be286f4d4292e5b2105af61181a2670089f9fb42e58d
-  data.tar.gz: 044e9282dfc9c0a7b01c3ae4420c44781ffe460819e58d46b2eb7a9f08ba02a91937afed977c9ed13d4f9aad168e2d7b308108e9f977e5c515b6285b74a8f2b6
+  metadata.gz: 6e767caf78326e1ed60678dfd22f4f5f8328fbb30dc520d5283f86c018708c3be2326ffb79df585453f7f995771dc8521e1c6ca48e0af787620a60b5de831d26
+  data.tar.gz: 1b699528fdcd23ab18921c825e646fd8de323c3d0497b3e482e99386f5ac008bd948ffc1889e9c32f82cbd6b8d40c74c62a18fbeee87622aebc34b043a86c2a4

data/lib/secure_headers.rb

@@ -24,7 +24,7 @@ module SecureHeaders
   class NoOpHeaderConfig
     include Singleton
 
-    def boom(arg = nil)
+    def boom(*args)
       raise "Illegal State: attempted to modify NoOpHeaderConfig. Create a new config instead."
     end
 

data/lib/secure_headers/middleware.rb

@@ -38,7 +38,7 @@ module SecureHeaders
 
     # disable Secure cookies for non-https requests
     def override_secure(env, config = {})
-      if scheme(env) != "https"
+      if scheme(env) != "https" && config != OPT_OUT
         config[:secure] = OPT_OUT
       end
 

data/secure_headers.gemspec

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 Gem::Specification.new do |gem|
   gem.name          = "secure_headers"
-  gem.version       = "4.0.0.alpha02"
+  gem.version       = "4.0.0.alpha03"
   gem.authors       = ["Neil Matatall"]
   gem.email         = ["neil.matatall@gmail.com"]
   gem.description   = "Manages application of security headers with many safe defaults."

data/spec/lib/secure_headers/middleware_spec.rb

@@ -65,6 +65,17 @@ module SecureHeaders
         end
       end
 
+      it "allows opting out of cookie protection with OPT_OUT alone" do
+        Configuration.default { |config| config.cookies = OPT_OUT}
+
+        # do NOT make this request https. non-https requests modify a config,
+        # causing an exception when operating on OPT_OUT. This ensures we don't
+        # try to modify the config.
+        request = Rack::Request.new({})
+        _, env = cookie_middleware.call request.env
+        expect(env["Set-Cookie"]).to eq("foo=bar")
+      end
+
       context "cookies should not be flagged" do
         it "does not flags cookies as secure" do
           Configuration.default { |config| config.cookies = {secure: OPT_OUT, httponly: OPT_OUT, samesite: OPT_OUT}  }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: secure_headers
 version: !ruby/object:Gem::Version
-  version: 4.0.0.alpha02
+  version: 4.0.0.alpha03
 platform: ruby
 authors:
 - Neil Matatall