super_good-csrf_protection 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e9d72a1f2adf6520a6be566c98402df02f4e59adb8567f985ace1823f3400a1a
-  data.tar.gz: 4e35d9e3cd61d94fc01a279ee0df1485649aa65431b6a27c6b109c24f7006ab2
+  metadata.gz: c38d5a4d889a7d8042dd87084aa0f76517d9ffc9b7c5155f2639942eea86f530
+  data.tar.gz: '093397982b8dc7e3e844f686a7d67670b1b47872bc1d85847fd33139d0cdeecb'
 SHA512:
-  metadata.gz: 4050fb91b22a24569e29c9ce52a0b07b5b693ea587b5d99ef25b1401e46cdc4a6a4860b3a0b58ba542e0c85bb567720fa135a725aabcee6fffe341db10ae5b1f
-  data.tar.gz: b6b597b61916f68d9416e33770f2826509c603fb4d446c52bc3c3829ea2e41bb5bd6919b2f8e81b008504425105fdb967dc767a7d1b1a6a86cf545d4680edc8b
+  metadata.gz: ff7b802cacf1bc487faba29b309cc74cca4ee5919a087d583769bbbcdf2baaa8befa72a3f3414ba4348995ac32e1f038e55d13264cd6877baf26e8697fe1bf3f
+  data.tar.gz: 48ac1c0d4c4d4d4a007829dd039eb22bee548ce43c614546436e68e29e2990b79e4071bc0b34eab7b7b6186a64f38b0c9886f0b309111317e2e6a58b41d6d684

data/README.md

@@ -1,13 +1,13 @@
 # SuperGood::CSRFProtection
 
-A Rack middleware for CSRF protection using the Sec-Fetch-Site header to prevent cross-site requests.
+This Rack middleware provides CSRF protection using the Sec-Fetch-Site header. It is inspired by Go's `http.CrossOriginProtection` which was introduced in Go 1.25. You can read about it [in this article](https://www.alexedwards.net/blog/preventing-csrf-in-go) and find more information about the `Sec-Fetch-Site` header [on MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Sec-Fetch-Site).
 
 ## Installation
 
 Add this line to your application's Gemfile:
 
 ```ruby
-gem 'super_good-csrf_protection'
+gem "super_good-csrf_protection"
 ```
 
 And then execute:
@@ -27,12 +27,12 @@ gem install super_good-csrf_protection
 Add the middleware to your Rack application:
 
 ```ruby
-require 'super_good/csrf_protection'
+require "super_good/csrf_protection"
 
 use SuperGood::CSRFProtection
 ```
 
-The middleware will automatically reject non-GET requests that don't have a `Sec-Fetch-Site: same-origin` header, providing protection against CSRF attacks.
+The middleware rejects all non-GET requests without the `Sec-Fetch-Site: same-origin` header, providing protection against CSRF attacks.
 
 ## Development
 

data/lib/super_good/csrf_protection/version.rb

@@ -2,6 +2,6 @@
 
 module SuperGood
   class CSRFProtection
-    VERSION = "0.1.0"
+    VERSION = "0.2.0"
   end
-end
+end

data/lib/super_good/csrf_protection.rb

@@ -6,22 +6,48 @@ module SuperGood
   class CSRFProtection
     class Error < StandardError; end
 
-    def initialize(app)
+    SAFE_METHODS = %w[GET HEAD OPTIONS].freeze
+    SAFE_SEC_FETCH_SITE_VALUES = %w[same-origin none].freeze
+
+    def initialize(app, raise_error: false)
       @app = app
+      @raise_error = raise_error
     end
 
     def call(env)
-      if unsafe_request?(env) && env["HTTP_SEC_FETCH_SITE"] != "same-origin"
-        raise(Error, "Invalid Sec-Fetch-Site header")
-      end
+      return @app.call(env) unless unsafe_request?(env) && cross_origin?(env)
 
-      @app.call(env) 
+      if @raise_error
+        raise(Error, "Cross-origin request denied")
+      else
+        [403, {"Content-Type" => "text/plain"}, ["Forbidden"]]
+      end
     end
 
     private
 
     def unsafe_request?(env)
-      env["REQUEST_METHOD"] != "GET"
+      !SAFE_METHODS.include?(env["REQUEST_METHOD"])
+    end
+
+    def cross_origin?(env)
+      sec_fetch_site = env["HTTP_SEC_FETCH_SITE"]
+      return !SAFE_SEC_FETCH_SITE_VALUES.include?(sec_fetch_site) if sec_fetch_site
+
+      origin = env["HTTP_ORIGIN"]
+      return false unless origin
+
+      host = env["HTTP_HOST"]
+      origin_host = extract_host_from_origin(origin)
+
+      origin_host != host
+    end
+
+    def extract_host_from_origin(origin)
+      uri = URI.parse(origin)
+      (uri.port == uri.default_port) ? uri.host : "#{uri.host}:#{uri.port}"
+    rescue URI::InvalidURIError
+      nil
     end
   end
-end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: super_good-csrf_protection
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Sofia Besenski
@@ -13,7 +13,8 @@ bindir: exe
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies: []
-description: A Rack middleware for handling the Sec-Fetch-Site header.
+description: A Rack middleware for preventing CSRF attacks using the Sec-Fetch-Site
+  header
 email:
 - sofia@super.gd
 - jared@super.gd
@@ -54,5 +55,5 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 rubygems_version: 3.6.9
 specification_version: 4
-summary: A Rack middleware for handling the Sec-Fetch-Site header.
+summary: A Rack middleware for preventing CSRF attacks using the Sec-Fetch-Site header
 test_files: []