warden-jwt_auth 0.3.2 → 0.3.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: e5ef370e2769321525a4f8d75188c541befe14f8
-  data.tar.gz: 719f327eca349ce320832fb46ca2057893feb2fc
+  metadata.gz: 707c2b046b0c4685a5c98b18456c305c1fafd23b
+  data.tar.gz: 82f98685925f55704ec296b24c0bfe08636951b4
 SHA512:
-  metadata.gz: ba697509f99e66bdc16a8eb7c4b3575ffefe7cc122e4ebf7ebc5a807eefbc2f6f5667e79b724b517b2b6078c731c3c3b955b7feadc71127b0d942664e4c29d68
-  data.tar.gz: 9b292cca9927bda28c92decf5170ef0f7c0f040e88770fb126591370c1b22fe49e9e27a8783e2844d0b81eda4dfb01d4811ffdff1822a6fa34402a647323f128
+  metadata.gz: bb23f8f0bca81024fdab60bceaeb5235eb06da768641ff212d84aadb8b9aa557adf6c70f5fa3ed53ccb43eb0287da33b1a5edfbb3282d46b9c3f7a5707e194e1
+  data.tar.gz: 2035526baabad186a0bb3aadb09ab3379ca0fab48a341b14071de57e5c9a794981596887d3a006376530e7bc861d743d5dd8f5119bd6a93587051367305582b7

data/CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/) 
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## [0.3.3] - 2017-12-31
+### Fixed
+- Check it is not a html request when disallowing fetching from session
+
 ## [0.3.2] - 2017-12-23
 ### Fixed
 - Do not couple `aud_header` env value to the setting

data/README.md

@@ -24,7 +24,7 @@ If what you need is a JWT authentication library for [devise](https://github.com
 ## Installation
 
 ```ruby
-gem 'warden-jwt_auth', '~> 0.3.2'
+gem 'warden-jwt_auth', '~> 0.3.3'
 ```
 
 And then execute:

data/lib/warden/jwt_auth/env_helper.rb

@@ -56,6 +56,16 @@ module Warden
         env_name = ('HTTP_' + JWTAuth.config.aud_header.upcase).tr('-', '_')
         env[env_name]
       end
+
+      # Returns whether `text/html` is within `Accept` header values
+      #
+      # @param env [Hash] Rack env
+      # @return [Boolean]
+      def self.html_request?(env)
+        accept = env['HTTP_ACCEPT']
+        return false unless accept
+        accept.include?('text/html')
+      end
     end
   end
 end

data/lib/warden/jwt_auth/hooks.rb

@@ -18,11 +18,12 @@ module Warden
         new.send(:prepare_token, user, auth, opts)
       end
 
-      # Sign out a JWT scope if it comes from the session.
+      # Sign out a JWT scope if it comes from the session unless it is an HTML
+      # request
       #
       # If a user is meant to be authenticated via JWT, then if it is fetched
-      # from the session it must be something not intended to happen and a
-      # security threat.
+      # from the session during an API request it must be something not intended
+      # to happen and a security threat.
       #
       # Workaround until https://github.com/hassox/warden/pull/118 is fixed
       def self.after_fetch(_user, auth, opts)
@@ -38,9 +39,11 @@ module Warden
         add_token_to_env(user, scope, env)
       end
 
+      # :reek:FeatureEnvy
       def logout_scope(auth, opts)
+        env = auth.env
         scope = opts[:scope]
-        return unless jwt_scope?(scope)
+        return if !jwt_scope?(scope) || EnvHelper.html_request?(env)
         auth.logout(scope)
       end
 

data/lib/warden/jwt_auth/version.rb

@@ -2,6 +2,6 @@
 
 module Warden
   module JWTAuth
-    VERSION = '0.3.2'
+    VERSION = '0.3.3'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: warden-jwt_auth
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.3.3
 platform: ruby
 authors:
 - Marc Busqué
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2017-12-23 00:00:00.000000000 Z
+date: 2017-12-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dry-configurable