sinatra-portier 1.5.2 → 2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cbb567b7fdc34ac49a53113b97b08a27b52c2fd1e85552c2ea44eb7cabfc9666
-  data.tar.gz: 3528e61f4a6fdc75ed3d2aee2bb80235a139860ca079b63d6ee3cfac487adbf3
+  metadata.gz: 7cd3476f061fb1de32d057c4f8a6161fb62e0321f47f0c6d264a31d3c16755f7
+  data.tar.gz: 1773f716e2a04c6e2b6de9c3fe221b4352004a3b1de09afb763846ff4ea34d17
 SHA512:
-  metadata.gz: ce0b199ca249d27d1cefc7db7c25f6bb5595165d7076843a190c448e61b596fcd2b0e3c362ddaf155ca6f7fb3002a73511b0ba4a8f111a5ffc1f5b1bc7b8e15c
-  data.tar.gz: 5c6e1b3cc2890c87f32bda865530accd31ff97df69c5977d1c1de5009337cda8f38447756da9ca202cfae8d34859c8f9d98a6a606efc4d76120ec5587dedceba
+  metadata.gz: 974c8c6c0464f36a73d93bde35a29545874da0ae0c1832d5cac4f0588e4e774fcaf365201e403936a1138c51c39efd07ebd14fb4fd857a72348d3fbf19779ba3
+  data.tar.gz: 4b305bc259bad7d833a74d3d27dfbc8922b83a5bb2b6dce48b3077f433b89de7d2635f5506e8c084647fef60b29b8b1973e1329e3390959af80565053b819600

data/lib/sinatra/browserid/helpers.rb

@@ -61,9 +61,14 @@ module Sinatra
         redirect_url ||= request.url
         session['redirect_url'] = redirect_url
 
-        nonce = session[:nonce]
-        unless nonce
-          session[:nonce] = nonce = SecureRandom.base64
+        if session[:nonce]
+            nonce = session[:nonce]
+            # Try to limit how many nonces are stored by keeping the session nonce alive
+            Cachy.delete_key(nonce)
+            Cachy.cache(nonce, expires_in: 600) { true }
+        else
+            session[:nonce] = nonce = SecureRandom.base64
+            Cachy.cache(nonce, expires_in: 600) { true }
         end
 
         template = ERB.new(Templates::LOGIN_BUTTON)

data/lib/sinatra/browserid.rb

@@ -10,11 +10,21 @@ require "sinatra/base"
 require 'sinatra/browserid/helpers'
 require 'sinatra/browserid/template'
 require 'addressable/uri'
+require 'cachy'
+require 'moneta'
+
 
 # This module provides an interface to verify a users email address
 # with browserid.org.
 module Sinatra
     module BrowserID
+
+        # Init an in-memory cache via the cachy gem. We use this
+        # instead of the session because of dropped sessions
+        # after redirects, see https://github.com/sinatra/sinatra/issues/1742.
+        Cachy.cache_store = Moneta.new(:Memory, expires: 600) # 10 minutes
+                                                              # We need to set a global :expires here because of https://github.com/grosser/cachy/issues/7
+    
         def self.registered(app)
             app.helpers BrowserID::Helpers
 
@@ -25,20 +35,18 @@ module Sinatra
             app.set :browserid_button_text, "Log in"
 
             app.get '/_browserid_login' do
-                # TODO(petef): render a page that initiates login without
-                # waiting for a user click.
                 render_login_button
             end
 
           app.post '/_browserid_assert' do
               begin
-                  # 3. Server checks signature
-                  # for that, fetch the public key from the LA instance (TODO: Do that beforehand for trusted instances, and generally cache the key)
+                  # Server checks signature
+                  # For that, fetch the public key from the LA instance (TODO: Do that beforehand for trusted instances, and generally cache the key)
                   public_key_jwks_uri = Addressable::URI.parse(settings.browserid_url + '/keys.json')
                   public_key_jwks = ::JSON.parse(URI.parse(public_key_jwks_uri).read)
                   public_key = OpenSSL::PKey::RSA.new
                   if public_key.respond_to? :set_key
-                    # set n and d via the new set_key function, as direct access to n and e is blocked for some ruby and openssl versions.
+                    # Set n and d via the new set_key function, as direct access to n and e is blocked for some ruby and openssl versions.
                     # Note that we have no d, as this is a public key, which would be the third param
                     public_key.set_key( (OpenSSL::BN.new UrlSafeBase64.decode64(public_key_jwks["keys"][0]["n"]), 2),
                                         (OpenSSL::BN.new UrlSafeBase64.decode64(public_key_jwks["keys"][0]["e"]), 2),
@@ -50,19 +58,25 @@ module Sinatra
                   
                   id_token = JWT.decode params[:id_token], public_key, true, { :algorithm => 'RS256' }
                   id_token = id_token[0]
-                  # 4. Needs to make sure token is still valid
+                  # Needs to make sure token is still valid
                   if (id_token["iss"] == settings.browserid_url &&
                       id_token["aud"] == request.base_url.chomp('/') &&        
                       id_token["exp"] > Time.now.to_i &&
                       id_token["email_verified"] &&
-                      id_token["nonce"] == session[:nonce])
+                      # nonce is really known to us
+                      Cachy.get(id_token["nonce"]))
                           session[:browserid_email] = id_token['email']
-                          session.delete(:nonce)
+                          Cachy.delete_key(id_token["nonce"])
+                          session.delete(:nonce)  # it's possible the session persisted
                           if session['redirect_url']
                             redirect session['redirect_url']
                           else
                             redirect "/"
                           end
+                  else
+                    # Even when the token check failed the nonce has to be invalidated
+                    Cachy.delete_key(id_token["nonce"])
+                    session.delete(:nonce)
                   end
               rescue OpenURI::HTTPError => e
                   puts "could not validate token: " + e.to_s
@@ -70,8 +84,8 @@ module Sinatra
               halt 403
               
             end
-        end # def self.registered
-    end # module BrowserID
+        end
+    end
     register BrowserID
-end # module Sinatra
+end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sinatra-portier
 version: !ruby/object:Gem::Version
-  version: 1.5.2
+  version: '2.0'
 platform: ruby
 authors:
 - Pete Fritchman
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-09-05 00:00:00.000000000 Z
+date: 2022-02-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sinatra
@@ -81,6 +81,34 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '2.8'
+- !ruby/object:Gem::Dependency
+  name: cachy
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.4'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.4'
+- !ruby/object:Gem::Dependency
+  name: moneta
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.4'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.4'
 description:
 email:
 - malte@paskuda.biz
@@ -114,7 +142,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.22
+rubygems_version: 3.2.32
 signing_key:
 specification_version: 4
 summary: Sinatra extension for user authentication with portier