subdomainbox 0.5.1 → 0.6.0

data/README.md

@@ -3,6 +3,8 @@ subdomainbox
 
 Subdomain boxing was inspired by Egor Homakov's [post on pageboxing](http://homakov.blogspot.com/2013/02/pagebox-website-gatekeeper.html). Subdomain boxing limits the reach of any XSS attacks. If an attacker manages to insert javascript onto a page of your application, the javascript on that page will be unable to read data from or post data to any pages on different subdomains in your application. POST protection is achieved by creating a separate CSRF token for each subdomain. CSRF protection is also strengthened by changing the CSRF token based on session id (request.session_options[:id]).
 
+Demo: http://app.subdomainbox.com
+
 The subdomainbox gem is simple to add even to existing Rails applications:
 
     class ApplicationController
@@ -17,20 +19,20 @@ The subdomainbox gem is simple to add even to existing Rails applications:
     end
 
 
-    class PostsController < ApplicationController
-
-      subdomainbox 'posts', :only => :index
-      subdomainbox ['posts-%{id}', 'comments-%{pop_id}'], :except => :index
+    class DocsController < ApplicationController
 
+      subdomainbox 'posts', :except => [:edit, :update, :show]
+      subdomainbox 'edit-%{id}', :only => [:edit, :update]
+      subdomainbox 'preview-%{id}', :only => :show
       ...
 
     end
 
 
-    class Admin::PostsController < ApplicationController
+    class Admin::DocsController < ApplicationController
 
       subdomainbox 'admin', :only => :index
-      subdomainbox 'admin-%{post_id}', :except => :index
+      subdomainbox 'admin-%{doc_id}', :except => :index
 
       ...
 
@@ -69,6 +71,8 @@ Installation
         end
         MyApp::Application.config.session_store :cookie_store, key: '_myapp_session', :domain => cookie_domain
 
+1. If you use Google Analytics, set up (cross subdomain tracking)[https://developers.google.com/analytics/devguides/collection/gajs/gaTrackingSite#domainSubDomains]
+
 Development
 ===========
 

data/VERSION

@@ -1 +1 @@
-0.5.1
+0.6.0

data/lib/subdomainbox/secure_csrf_token.rb

@@ -10,10 +10,10 @@ module ActionController #:nodoc:
       # Sets the token value for the current session.
       def form_authenticity_token
         raise 'CSRF token secret must be defined' if CSRF_TOKEN_SECRET.nil? || CSRF_TOKEN_SECRET.empty?
-        if request.session_options[:id]
-          Digest::SHA1.hexdigest("#{CSRF_TOKEN_SECRET}#{request.session_options[:id]}#{request.subdomain}")
-        else
+        if @default_subdomainbox_removed || request.session_options[:id].nil?
           original_form_authenticity_token
+        else
+          Digest::SHA1.hexdigest("#{CSRF_TOKEN_SECRET}#{request.session_options[:id]}#{request.subdomain}")
         end
       end
 

data/lib/subdomainbox/subdomainbox.rb

@@ -17,7 +17,7 @@ module ActionController
     end
 
     def subdomainbox(box_definitions)
-      @remove_default_subdomainbox = true
+      @default_subdomainbox_removed = true
       subdomain_match = subdomainbox_find_subdomain_match(box_definitions)
       subdomainbox_no_subdomain_match!(box_definitions) if subdomain_match.nil?
     end
@@ -27,7 +27,7 @@ module ActionController
     # from any subdomain)
     #
     def remove_default_subdomainbox
-      @remove_default_subdomainbox = true
+      @default_subdomainbox_removed = true
     end
 
     # set up a default subdomain box for all controllers that won't get an explicit subdomain box
@@ -35,7 +35,7 @@ module ActionController
     # from a subdomain boxed page
     #
     def default_subdomainbox(box_definitions)
-      subdomainbox(box_definitions) unless @remove_default_subdomainbox
+      subdomainbox(box_definitions) unless @default_subdomainbox_removed
     end
 
     private

data/spec/secure_csrf_token_spec.rb

@@ -22,13 +22,23 @@ describe "ActionController::RequestForgeryProtection" do
     end
 
     context "when the user has a session" do
+      before(:each) do
+        request.stub_chain(:session_options, :[]).and_return('abc')
+      end
 
       it "should be generated from the CSRF_TOKEN_SECRET salted with the session id and the subdomain" do
-        request.stub_chain(:session_options, :[]).and_return('abc')
         CSRF_TOKEN_SECRET = 'xyz'
         form_authenticity_token.should == Digest::SHA1.hexdigest('xyzabcpets')
       end
 
+      context "when the default subdomainbox has been removed" do
+        it "should call the original form_authenticity_token" do
+          @default_subdomainbox_removed = true
+          self.should_receive(:original_form_authenticity_token)
+          form_authenticity_token
+        end
+      end
+
     end
 
     context "when there is no session id" do

data/subdomainbox.gemspec

@@ -5,11 +5,11 @@
 
 Gem::Specification.new do |s|
   s.name = "subdomainbox"
-  s.version = "0.5.1"
+  s.version = "0.6.0"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Daniel Nelson"]
-  s.date = "2013-03-25"
+  s.date = "2013-05-02"
   s.description = "use subdomains to prevent XSS from accessing your entire application if it should happen to be injected into some page in your app"
   s.email = "dnelson@centresource.com"
   s.extra_rdoc_files = [

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: subdomainbox
 version: !ruby/object:Gem::Version
-  version: 0.5.1
+  version: 0.6.0
   prerelease: 
 platform: ruby
 authors:
@@ -9,11 +9,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-03-25 00:00:00.000000000 Z
+date: 2013-05-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: uuidtools
-  requirement: &2152059740 !ruby/object:Gem::Requirement
+  requirement: &2164367660 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -21,10 +21,10 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *2152059740
+  version_requirements: *2164367660
 - !ruby/object:Gem::Dependency
   name: rspec
-  requirement: &2152058780 !ruby/object:Gem::Requirement
+  requirement: &2164365580 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - =
@@ -32,10 +32,10 @@ dependencies:
         version: 2.10.0
   type: :development
   prerelease: false
-  version_requirements: *2152058780
+  version_requirements: *2164365580
 - !ruby/object:Gem::Dependency
   name: jeweler
-  requirement: &2152112060 !ruby/object:Gem::Requirement
+  requirement: &2164355360 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -43,10 +43,10 @@ dependencies:
         version: 1.8.4
   type: :development
   prerelease: false
-  version_requirements: *2152112060
+  version_requirements: *2164355360
 - !ruby/object:Gem::Dependency
   name: pry
-  requirement: &2152110740 !ruby/object:Gem::Requirement
+  requirement: &2164354280 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -54,10 +54,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *2152110740
+  version_requirements: *2164354280
 - !ruby/object:Gem::Dependency
   name: pry-nav
-  requirement: &2152108660 !ruby/object:Gem::Requirement
+  requirement: &2164352920 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -65,10 +65,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *2152108660
+  version_requirements: *2164352920
 - !ruby/object:Gem::Dependency
   name: pry-stack_explorer
-  requirement: &2152107320 !ruby/object:Gem::Requirement
+  requirement: &2164351700 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -76,7 +76,7 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *2152107320
+  version_requirements: *2164351700
 description: use subdomains to prevent XSS from accessing your entire application
   if it should happen to be injected into some page in your app
 email: dnelson@centresource.com
@@ -118,7 +118,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: -1018777487133078925
+      hash: -3756000022176297036
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements: