static-rails 0.0.6 → 0.0.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2349033fed70d1dbc50caca67852f874e22800cf89dd94ef51580b3ed3a66452
-  data.tar.gz: 75bfdbdf6dbaef89c4c6b6674de1e08d99ca18dff795fa12b25f3d6bb00b218d
+  metadata.gz: 71c1a0e6ce72ea1feb691e3cbfae0bec8bf723f1512cda383aeae57d56fd9765
+  data.tar.gz: 4d8d3c148661b2498ccfeb3677553e94a91c2cb68b5c48ba47aaace89be8adfe
 SHA512:
-  metadata.gz: 3ea5b2102c354c715a09ebb33874b5488e1039349dc3b0c3e98135ea03108d52d88f8ca8cba7ec9ffcafff8f94a007792b5813f02f5c86ea5f88f6103b860427
-  data.tar.gz: e2ba3a00c004b86eb1364f4ea34559f86695347733ee158b3d57cea9cf669864585449ba042e59b1efbe1b1ce14487d470b6f732e9e2843030e057cf848050b3
+  metadata.gz: cc39f818e745f67930b8821dbf3b38cdfd34d33accd25979801a4fbc34df67cdf600e517a2fe806f6094e43bc2e797fcef2aa4b1bb7006f3d75317a26b19ea82
+  data.tar.gz: c0879dc6ef5950806aaa662035ac7593a78c334dc578f65bd5e13526d1f4c770a08b9cf1f2b8fc8e21a9d00372876736924e05687e4d33ebbb780acc5b802ea1

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 0.0.7
+
+* Ensure that CSRF tokens are valid, at the cost of some performance and
+  reliance on additional Rails internals. As a result CSRF cookie setting is now
+  disabled by default [#6](https://github.com/testdouble/static-rails/pull/6)
+
 ## 0.0.6
 
 * Fix an issue where `ActionDispatch::FileHandler` won't be loaded in the event

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    static-rails (0.0.6)
+    static-rails (0.0.7)
       rack-proxy (~> 0.6)
       railties (>= 5.0.0)
 

data/README.md

@@ -84,13 +84,14 @@ overall behavior of the gem itself, across all your static sites:
   `proxy_requests` is true, that the gem will wait for a response from a static
   site's server on any given request before timing out and raising an error
 
-* **config.set_csrf_token_cookie** (Default: `true`) when true, the gem's
+* **config.set_csrf_token_cookie** (Default: `false`) when true, the gem's
   middleware will set a cookie named `_csrf_token` with each request of your
   static site. You can use this to set the `'x-csrf-token'` header on any
   requests from your site back to routes hosted by the Rails app that are
   [protected from CSRF
   forgery](https://guides.rubyonrails.org/security.html#cross-site-request-forgery-csrf)
-  (if you're not using Rails' cookie store for sessions, turn this off)
+  (if you're not using Rails' cookie store for sessions or you're okay with API
+  calls bypassing Rails CSRF, leave this off)
 
 ### Configuring your static sites themselves
 

data/lib/generators/templates/static.rb

@@ -12,7 +12,7 @@ StaticRails.config do |config|
   # When true, both the proxy & static asset middleware will set a cookie
   #   named "_csrf_token" to the Rails CSRF token, allowing any client-side
   #   API requests to take advantage of Rails' request forgery protection
-  # config.set_csrf_token_cookie = true
+  # config.set_csrf_token_cookie = false
 
   # The list of static sites you are hosting with static-rails.
   # Note that order matters! Request will be forwarded to the first site that

data/lib/static-rails/configuration.rb

@@ -30,7 +30,7 @@ module StaticRails
       @proxy_requests = !Rails.env.production?
       @serve_compiled_assets = Rails.env.production?
       @ping_server_timeout = 5
-      @set_csrf_token_cookie = true
+      @set_csrf_token_cookie = false
     end
 
     attr_reader :sites

data/lib/static-rails/site_middleware.rb

@@ -1,7 +1,6 @@
 require_relative "proxy_middleware"
 require_relative "static_middleware"
 require_relative "determines_whether_to_handle_request"
-require_relative "gets_csrf_token"
 
 module StaticRails
   class SiteMiddleware
@@ -17,7 +16,7 @@ module StaticRails
     def call(env)
       return @app.call(env) unless @determines_whether_to_handle_request.call(env)
 
-      if require_csrf_before_processing_request? && !csrf_token_is_set?(env)
+      if require_csrf_before_processing_request?
         # You might be asking yourself what the hell is going on here. In short,
         # This middleware sits at the top of the stack, which is too early to
         # set a CSRF token in a cookie. Therefore, we've placed a subclass of
@@ -55,9 +54,5 @@ module StaticRails
     def require_csrf_before_processing_request?
       StaticRails.config.set_csrf_token_cookie
     end
-
-    def csrf_token_is_set?(env)
-      Rack::Request.new(env).cookies.has_key?("_csrf_token")
-    end
   end
 end

data/lib/static-rails/site_plus_csrf_middleware.rb

@@ -1,11 +1,13 @@
 require_relative "site_middleware"
 require_relative "determines_whether_to_handle_request"
+require_relative "validates_csrf_token"
 require_relative "gets_csrf_token"
 
 module StaticRails
   class SitePlusCsrfMiddleware < SiteMiddleware
     def initialize(app)
       @determines_whether_to_handle_request = DeterminesWhetherToHandleRequest.new
+      @validates_csrf_token = ValidatesCsrfToken.new
       @gets_csrf_token = GetsCsrfToken.new
       super
     end
@@ -21,10 +23,12 @@ module StaticRails
       if StaticRails.config.set_csrf_token_cookie
         req = Rack::Request.new(env)
         res = Rack::Response.new(body, status, headers)
-        res.set_cookie("_csrf_token", {
-          value: @gets_csrf_token.call(req),
-          path: "/"
-        })
+        if needs_new_csrf_token?(req)
+          res.set_cookie("_csrf_token", {
+            value: @gets_csrf_token.call(req),
+            path: "/"
+          })
+        end
         res.finish
       else
         [status, headers, body]
@@ -36,5 +40,11 @@ module StaticRails
     def require_csrf_before_processing_request?
       false
     end
+
+    private
+
+    def needs_new_csrf_token?(req)
+      !req.cookies.has_key?("_csrf_token") || !@validates_csrf_token.call(req)
+    end
   end
 end

data/lib/static-rails/validates_csrf_token.rb

@@ -0,0 +1,26 @@
+module StaticRails
+  class ValidatesCsrfToken
+    def call(req)
+      valid_authenticity_token?(req.session, req.cookies["_csrf_token"])
+    end
+
+    private
+
+    [
+      :valid_authenticity_token?,
+      :unmask_token,
+      :compare_with_real_token,
+      :valid_per_form_csrf_token?,
+      :xor_byte_strings,
+      :real_csrf_token
+    ].each do |method|
+      define_method method do |*args, **kwargs, &blk|
+        ActionController::RequestForgeryProtection.instance_method(method).bind(self).call(*args, **kwargs, &blk)
+      end
+    end
+
+    def per_form_csrf_tokens
+      false
+    end
+  end
+end

data/lib/static-rails/version.rb

@@ -1,3 +1,3 @@
 module StaticRails
-  VERSION = "0.0.6"
+  VERSION = "0.0.7"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: static-rails
 version: !ruby/object:Gem::Version
-  version: 0.0.6
+  version: 0.0.7
 platform: ruby
 authors:
 - Justin Searls
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-05-21 00:00:00.000000000 Z
+date: 2020-05-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -75,6 +75,7 @@ files:
 - lib/static-rails/site_middleware.rb
 - lib/static-rails/site_plus_csrf_middleware.rb
 - lib/static-rails/static_middleware.rb
+- lib/static-rails/validates_csrf_token.rb
 - lib/static-rails/version.rb
 - lib/static-rails/waits_for_connection.rb
 - lib/tasks/static-rails.rake