simple_session 0.2.3 → 0.3.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: bc7cc686a18d938b53ac97732ed364f8748dbe8b
-  data.tar.gz: f1f99526496a442f389eed962e1369c774cf88da
+  metadata.gz: 83dc3c7b1992f0d05a7166de51c41c350e908dad
+  data.tar.gz: 9c562864c93af1b1a23d09de26b469708d017b57
 SHA512:
-  metadata.gz: 2f35593ee666a5218c572e7fc2608902934db616642e2e7255f9247dc738fdeb18e8a40add85af1b8bf7a9d70c759cad837c45d64137cc4e6e67a8065256b1fe
-  data.tar.gz: 1cecd565c55012dd2e7e7a456feeff3b42eb24681a45abb90ef32321cd3b374a36881ee76c2f7e34260ad450ad98b6fa2edd3642133b7b12e78eadd6241cc5b8
+  metadata.gz: 7ba09f3c14291e46e361a215e30e6b213a2389d55143491ea98f40106ccc618b15ddaf97f38ea5dc30700feca9b5612bec4b19af431ac22a0c0736a91cf94655
+  data.tar.gz: b20f02781c54a948ffedaddea97ce0994444626cae4dc8b4c126021af67ac4129c834da49eb0f7d436f1fbc9c209c247f483bd320907fe281c2e0c029aa2a87f

data/Gemfile

@@ -2,3 +2,4 @@ source 'https://rubygems.org'
 
 # Specify your gem's dependencies in simple_session.gemspec
 gemspec
+

data/README.md

@@ -1,9 +1,12 @@
 # SimpleSession
 ![build-status](https://travis-ci.org/hayduke19us/simple_session.svg?branch=master)
 
+![Gem Version](https://badge.fury.io/rb/simple_session.svg)
+
 This is a drop in replacement for rack session. By default
-the session cookie is encrypted in AES-256-CBC and requires a secret
-which is recommended to be kept in an .env file or something similar. 
+the session cookie is encrypted in AES-256-CBC and requires a secret which is
+recommended to be kept in an .env file or something similar. The session is also
+signed with an HMAC signature in a double ended fashion that prevents tampering.
 
 <a href='#install-sect'><h4>Installation</h4></a>
 

data/lib/simple_session/base.rb

@@ -36,10 +36,6 @@ module SimpleSession
       request.cookies[@key] if request
     end
 
-    def req_options
-      session[:options] if session
-    end
-
     def new_session_hash
       { session_id: SecureRandom.hex(32) }
     end
@@ -64,20 +60,18 @@ module SimpleSession
       [status, headers, body]
     end
 
-    private
     def extract_session env
       begin
         @request = Rack::Request.new env
         @session = req_session ? decrypt(req_session) : new_session_hash
+        session.merge!(options_hash)
+        raise ArgumentError, "Unable to decrypt session" unless session
 
-        raise ArgumentError, "Unable to decrypt session" unless @session
-
-      rescue => e
-        @session = new_session_hash
-        puts e.message
+      rescue Exception => e
+        @session = new_session_hash.merge!(options_hash)
+        print e.message
       end
 
-      @options = options_hash
     end
 
     def options_hash
@@ -87,13 +81,13 @@ module SimpleSession
 
     def load_environment env
       env[@key] = session.dup
-      env[@options_key] = @options[:options].dup
+      env[@options_key] = session[:options].dup
     end
 
     def add_session headers
       cookie = Hash.new
-      cookie[:value] = encrypt session.merge(@options)
-      cookie.merge!(@options[:options])
+      cookie.merge!(session.fetch(:options, @default_opts))
+      cookie[:value] = encrypt session
 
       set_cookie_header headers, @key, cookie
     end
@@ -103,21 +97,25 @@ module SimpleSession
     end
 
     def update_options
-      @options = {options: OptionHash.new(request.session_options).opts}
+      session[:options] = {options: OptionHash.new(request.session_options).opts}
     end
 
     def options_changed? 
-      request.session_options != @options[:options]
+      request.session_options != session[:options]
     end
 
     def session_changed?
-      request.session != @session
+      request.session != session
     end
 
     def update_session
       @session = request.session
     end
 
+    def signature
+      hmac(cipher_key)
+    end
+
     def encrypt data
       # Serialize
       m = Marshal.dump data
@@ -125,19 +123,29 @@ module SimpleSession
       # Cipher
       c = load_cipher m
 
+      # Sign
+      h = signature + c + signature
+
       # Encode Base64
-      [c].pack('m')
+      [h].pack('m0')
     end
 
     def decrypt data
       # Decode Base64
-      b = data.unpack('m').first
-
-      # Decipher
-      c = unload_cipher b
-
-      # Deserialize
-      Marshal.load c
+      b = data.unpack('m0').first
+
+      # Parse Signature
+      h1   = b[0, 32]
+      data = b[32..-1]
+      h2   = data.reverse[0, 32].reverse
+      data = data.reverse[32..-1].reverse
+
+      if h1 == signature.to_s && h2 == signature.to_s
+        # Decipher
+        Marshal.load unload_cipher data
+      else
+        raise SecurityError
+      end
     end
 
     def digest
@@ -171,7 +179,7 @@ module SimpleSession
     end
 
     def cipher_key
-      hmac("A red, red fox has had three socks but all have holes")
+      hmac("A red, red fox has had three socks but all have holes" + @secret)
     end
 
     class OptionHash

data/lib/simple_session/version.rb

@@ -1,3 +1,3 @@
 module SimpleSession
-  VERSION = "0.2.3"
+  VERSION = "0.3.3"
 end

data/simple_session.gemspec

@@ -9,9 +9,12 @@ Gem::Specification.new do |spec|
   spec.authors       = ["hayduke19us"]
   spec.email         = ["hayduke19us@gmail.com"]
 
-  spec.summary       = %q{A simple middleware providing rack with a session cookie.}
-  spec.description   = %q{Provides an AES-256-CBC encrypted session cookie
-                          with the option to set max-age. Honors rack's
+  spec.summary       = %q{A simple middleware providing rack with an
+                          encrypted session cookie.}
+  spec.description   = %q{Provides an AES-256-CBC encrypted session cookie signed
+                          with and HMAC digest in a double ended manor. 
+                          Cookie options include max-age, path, domain, http-only,
+                          and secure. Honors Rack's
                           methods like session and request.session_options}
   spec.homepage      = "https://github.com/hayduke19us/simple_session"
   spec.license       = "MIT"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: simple_session
 version: !ruby/object:Gem::Version
-  version: 0.2.3
+  version: 0.3.3
 platform: ruby
 authors:
 - hayduke19us
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2015-11-12 00:00:00.000000000 Z
+date: 2015-11-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -122,10 +122,10 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: |-
-  Provides an AES-256-CBC encrypted session cookie
-                            with the option to set max-age. Honors rack's
-                            methods like session and request.session_options
+description: "Provides an AES-256-CBC encrypted session cookie signed\n                          with
+  and HMAC digest in a double ended manor. \n                          Cookie options
+  include max-age, path, domain, http-only,\n                          and secure.
+  Honors Rack's\n                          methods like session and request.session_options"
 email:
 - hayduke19us@gmail.com
 executables: []
@@ -168,5 +168,5 @@ rubyforge_project:
 rubygems_version: 2.4.5
 signing_key: 
 specification_version: 4
-summary: A simple middleware providing rack with a session cookie.
+summary: A simple middleware providing rack with an encrypted session cookie.
 test_files: []