sqrl-rack 0.1.0 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4513d44fc6444b9976a2e286cf6edb442c68a03fd02aede2aebce4c57d8c8b3a
-  data.tar.gz: 5963d6bf1ce3f90ea6f963d4495e03f23d551c69365d346a42aa4c2ac57e539d
+  metadata.gz: 613199a036a2c3b8a43b8c9b8c1baea5507d4da6ae57d10eed72687935b7346f
+  data.tar.gz: 69de70f7d37d788c1c33b392cf5346024c0ff531d46056366ba10cfdd0414a94
 SHA512:
-  metadata.gz: 80aa33c71ed274a44c315c7a10b9d1292f412a13bc7d966fc9d72b05123b00f58d62b2b2bd186d18abf8b397a9bc3917c3bbf18c8e2153804460e05989b3aaf5
-  data.tar.gz: 66d970edec43830373ee5954d2753094e286896f3472d1800c365b689e5ab62e9b6c9d0304e6fcb9d4c65913d4c51e6536d50a97890caa65058dc5513c3da933
+  metadata.gz: 8119c8222f7f1637a80edcf4c9dcac462836dec4477aaa4be385dce3b29fb43015851aceec11bdade4b04ad30e8ecec6cf195cebc018455d1c8d76aa054ed31d
+  data.tar.gz: 4b64f3ac2ec52026ff1deacb7396d15d48b7de759c70d7d8c8e95d5b61b8dee0d23852ac38a4e340726ee742810131f7469ea30af3e6beeeb3d17763df125cb8

data/CHANGELOG.md

@@ -1,9 +1,41 @@
 # Changelog
 
-## 0.1.0 — 2026-10-20
+All notable changes to `sqrl-rack` are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this
+project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Every gem in
+the family shares one version number and is released in lockstep.
+
+## [Unreleased]
+
+## [0.1.2] - 2026-10-21
+
+### Changed
+
+- Requires sqrl-core 0.1.2 (protocol conformance fixes and the S4 trailing-byte fix; see its
+  changelog).
+
+### Security
+
+- A login the SQRL client completed in CPS mode (`opt=cps`) can no longer be completed
+  through the browser's status poll or a token-less callback. The specification requires the
+  server not to sign in the browser that displayed the login page in that case, because that
+  page may be a spoof; only the browser the client redirects to the one-time `url=` token is
+  signed in.
+
+## [0.1.1] - 2026-10-20
+
+### Changed
+
+- Requires sqrl-core 0.1.1, which fixes the `NoMethodError` on Ruby 3.1 and 3.2. No other
+  changes.
+
+## [0.1.0] - 2026-10-20
 
 First release.
 
+### Added
+
 - `SQRL::Rack::Middleware`: the SQRL endpoint, cookie-bound status poll, CPS and poll
   callbacks, `sqrl.js` and a refresh endpoint, with a request facade (`env["sqrl.server"]`).
 - `Sinatra::SQRL` extension and a Roda `plugin :sqrl` with the same helpers.
@@ -14,3 +46,8 @@ First release.
 - Always issues `sqrl://`; `insecure_http: true` is a loopback-only testing mode.
 - `poll_requires_ip_match` (off by default) and 429 handling for rate-limit hooks.
 - Requires Ruby 3.1+, Rack 2.2 or 3.x, `rqrcode`.
+
+[Unreleased]: https://github.com/danielpclark/sqrl-ruby/compare/v0.1.2...HEAD
+[0.1.2]: https://github.com/danielpclark/sqrl-ruby/compare/v0.1.1...v0.1.2
+[0.1.1]: https://github.com/danielpclark/sqrl-ruby/compare/v0.1.0...v0.1.1
+[0.1.0]: https://github.com/danielpclark/sqrl-ruby/releases/tag/v0.1.0

data/README.md

@@ -1,6 +1,6 @@
 # sqrl-rack
 
-SQRL login for Rack applications and Sinatra: a middleware that mounts the SQRL endpoint,
+SQRL login for Rack applications, Sinatra and Roda: a middleware that mounts the SQRL endpoint,
 the browser's status poll and the login callback; a Sinatra extension with view helpers;
 the browser-side `sqrl.js`; and QR code rendering. Built on
 [`sqrl-core`](../sqrl-core).
@@ -32,9 +32,10 @@ run ->(env) {
 
 The middleware serves `POST /sqrl/cli` (the SQRL protocol endpoint), `GET /sqrl/status`
 (cookie-bound JSON poll), `GET /sqrl/callback` (login completion, with or without a CPS
-token) and `GET /sqrl/sqrl.js`. Everything else gets `env["sqrl.server"]`, a
-`SQRL::Rack::Facade` with `login_url`, `login_block`, `script_tag`, `qr_svg`,
-`identity`, `authenticated?` and `logout!`.
+token), `GET /sqrl/refresh` (a fresh login URL for the page) and `GET /sqrl/sqrl.js`.
+Everything else gets `env["sqrl.server"]`, a `SQRL::Rack::Facade` with `login_url`,
+`login_block`, `script_tag`, `qr_svg`, `refresh_url`, `identity`, `authenticated?` and
+`logout!`.
 
 Every `SQRL::Server::Config` option is accepted (`on_unknown_identity`, `ask`, `sin`,
 `require_ip_match`, `nut_ttl`, `cps_token_ttl`, ...). Without `host:` the request host is
@@ -179,8 +180,9 @@ element dispatches `sqrl:cps-detected`, `sqrl:authenticated` (`detail.next`),
 5. The middleware stores the identity in the session, runs `on_login`, and redirects to the
    pending login's `return_to` or `after_login`.
 
-See [`examples/rack-app`](../../examples/rack-app) and
-[`examples/sinatra-app`](../../examples/sinatra-app). and [`examples/roda-app`](../../examples/roda-app).
+See [`examples/rack-app`](../../examples/rack-app),
+[`examples/sinatra-app`](../../examples/sinatra-app) and
+[`examples/roda-app`](../../examples/roda-app).
 
 ## Testing
 

data/lib/sqrl/rack/endpoint.rb

@@ -174,8 +174,14 @@ module SQRL
         Completion.new(identity: identity, pending_login: login, via: via)
       end
 
-      # Whether a pending login may be completed without a CPS token.
+      # Whether a pending login may be completed without a CPS token. Never when the SQRL
+      # client flagged +cps+: the server then "MUST NOT authenticate the browser session upon
+      # successful authentication" (On The Wire v1.07, +url=+); only the browser that presents
+      # the one-time token the client received may complete it. Otherwise a spoofed login
+      # page that keeps polling would be signed in, which is exactly what CPS exists to stop.
       def poll_completable?(login)
+        return false if login.cps?
+
         !@poll_requires_ip_match || login.ip_matched == true
       end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sqrl-rack
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.2
 platform: ruby
 authors:
 - Daniel P. Clark
@@ -49,14 +49,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.1.0
+        version: 0.1.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.1.0
+        version: 0.1.2
 description: Rack middleware serving the SQRL endpoint, status poll and CPS callback,
   a Sinatra extension with view helpers, the browser-side script and QR code rendering.
 email: