utopia 2.5.3 → 2.5.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2e4f7ed0e917892a978b87d88b3ed57ef0e2c931121f3a45da37dba7be0f0907
-  data.tar.gz: b20c0f964a4f9ddc7695b76c8bc608b06bf7aa5eb5127abff8c81c2e2aa68386
+  metadata.gz: 8fef52d1f6de5c2a8e44763e7f6e7b59869e8a678627b3331876c788a8d1d5c2
+  data.tar.gz: 0b89a96822bb9601711c411fd61eeaaf31821f79ec97d15653d8f6f113d0662d
 SHA512:
-  metadata.gz: 0b79dce92c2c6bc7465eed78dee533eaf3ca9569a0b041e8681e53bc46a239b922a3dc86470b55d61cd4f55c0fd1f28dbdf674f5ba4f6764690371516f044f95
-  data.tar.gz: cf229b496e85607701adbed264ca9c8db098da0a5cda247ace80960b4c58a239e37b3e6a997660a1ad9b8fdbca97c3b5fa9979353994fcdeaa3a6c73d3cc67e9
+  metadata.gz: 656d6a39c064ec5078e8ef16782a013491bcb14b33f8102d4ed0db7e6205152d4bbb25ff0d58afdf328f14c41e43d7dad1234aab68ab2f8a0f483f22ee40fddb
+  data.tar.gz: fbb4f8d06aa9181fc06523b2dc0f67872400f7d868ed1f05e6f73d9a07462b6563695613258239352efdbcd83ae3ca7b04cd555eb24f39b2c956c08d3ce89eef

data/lib/utopia/session.rb

@@ -42,7 +42,7 @@ module Utopia
 		# @param secret [Array] The secret text used to generate a symetric encryption key for the coookie data.
 		# @param expires_after [String] The cache-control header to set for static content.
 		# @param options [Hash<Symbol,Object>] Additional defaults used for generating the cookie by `Rack::Utils.set_cookie_header!`.
-		def initialize(app, session_name: RACK_SESSION, secret: nil, expires_after: DEFAULT_EXPIRES_AFTER, update_timeout: DEFAULT_UPDATE_TIMEOUT, **options)
+		def initialize(app, session_name: RACK_SESSION, secret: nil, expires_after: DEFAULT_EXPIRES_AFTER, update_timeout: DEFAULT_UPDATE_TIMEOUT, secure: false, **options)
 			@app = app
 			
 			@session_name = session_name
@@ -63,7 +63,7 @@ module Utopia
 				domain: nil,
 				path: "/",
 				# The Secure attribute is meant to keep cookie communication limited to encrypted transmission, directing browsers to use cookies only via secure/encrypted connections. However, if a web server sets a cookie with a secure attribute from a non-secure connection, the cookie can still be intercepted when it is sent to the user by man-in-the-middle attacks. Therefore, for maximum security, cookies with the Secure attribute should only be set over a secure connection.
-				secure: false,
+				secure: secure,
 				# The HttpOnly attribute directs browsers not to expose cookies through channels other than HTTP (and HTTPS) requests. This means that the cookie cannot be accessed via client-side scripting languages (notably JavaScript), and therefore cannot be stolen easily via cross-site scripting (a pervasive attack technique).
 				http_only: true,
 			}.merge(options)
@@ -122,8 +122,7 @@ module Utopia
 		# Constructs a valid session for the given request. These fields must match as per the checks performed in `valid_session?`:
 		def build_initial_session(request)
 			{
-				request_ip: request.ip,
-				request_user_agent: request.user_agent,
+				user_agent: request.user_agent,
 				created_at: Time.now.utc,
 				updated_at: Time.now.utc,
 			}
@@ -146,14 +145,8 @@ module Utopia
 		end
 		
 		def valid_session?(request, values)
-			if values[:request_ip] != request.ip
-				warn "Invalid session because #{values[:request_ip]} doesn't match #{request.ip}!"
-				
-				return false
-			end
-			
-			if values[:request_user_agent] != request.user_agent
-				warn "Invalid session because #{values[:request_user_agent]} doesn't match #{request.user_agent}!"
+			if values[:user_agent] != request.user_agent
+				warn "Invalid session because #{values[:user_agent]} doesn't match #{request.user_agent}!" if $VERBOSE
 				
 				return false
 			end

data/lib/utopia/version.rb

@@ -19,5 +19,5 @@
 # THE SOFTWARE.
 
 module Utopia
-	VERSION = "2.5.3"
+	VERSION = "2.5.4"
 end

data/spec/utopia/session_spec.rb

@@ -103,12 +103,12 @@ module Utopia::SessionSpec
 			expect(last_response.body).to be == ""
 		end
 		
-		it "should fail if ip address is changed" do
+		it "shouldn't fail if ip address is changed" do
 			# Change user agent:
 			header 'X-Forwarded-For', '127.0.0.10'
 			
 			get "/session-get?key=foo"
-			expect(last_response.body).to be == ""
+			expect(last_response.body).to be == "bar"
 		end
 	end
 	

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: utopia
 version: !ruby/object:Gem::Version
-  version: 2.5.3
+  version: 2.5.4
 platform: ruby
 authors:
 - Samuel Williams
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-10-31 00:00:00.000000000 Z
+date: 2018-11-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: trenni