warden-jwt_auth 0.3.4 → 0.3.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 3792baa44346d5f08fdf21da1af6df6e0400ac8e
-  data.tar.gz: cae4999199e844a67da81ca6a9c2c1934c97c878
+  metadata.gz: 581e544d6b6fccb8635aac2719efefbbb5b760e8
+  data.tar.gz: e36d38d069f456bccc0b8eece033c7419da005ac
 SHA512:
-  metadata.gz: 3a5685a38e2c21a7d005e57ee5e2b5b73f94eb801118a9faae685e69f5e723e41e27bc17cfdc296f220ec2a5250614f33981ae154b57885ca88fd86507dd3989
-  data.tar.gz: aa63cee9efe1e7f4a7f408d0a6257c5fd61d42d19aaf21da700f26bd1c877415548c571cf155182b072981de1096b17683eafb64c3b70045afded744145ec6ce
+  metadata.gz: e8b1e212fa604ed3b2af19aa44392c625f6192869750d479be7af50f0c426c5961fa91497d95385d5bfa452b528fadf474283f744880debba8547c7d16329177
+  data.tar.gz: 67a9837cc9c55f1fd4cf1970d1891e68c3e59a8262e4161835e398b827fc1074b5f8df9ba3121196dec197e51237c024b0f708139e633437e4c0ba547c101385

data/CHANGELOG.md

@@ -4,7 +4,11 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/) 
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
-## [0.3.4] - 2018-12-09
+## [0.3.5] - 2018-01-30
+### Fixed
+- Do not disallow fetching JWT scopes from session
+
+## [0.3.4] - 2018-01-09
 ### Fixed
 - Do not log out from session for standard AJAX requests
 

data/README.md

@@ -24,7 +24,7 @@ If what you need is a JWT authentication library for [devise](https://github.com
 ## Installation
 
 ```ruby
-gem 'warden-jwt_auth', '~> 0.3.4'
+gem 'warden-jwt_auth', '~> 0.3.5'
 ```
 
 And then execute:

data/lib/warden/jwt_auth/env_helper.rb

@@ -56,18 +56,6 @@ module Warden
         env_name = ('HTTP_' + JWTAuth.config.aud_header.upcase).tr('-', '_')
         env[env_name]
       end
-
-      # Heuristic to determinate whether the request is not meant to be consumed
-      # by an API endpoint
-      #
-      # @param env [Hash] Rack env
-      # @return [Boolean]
-      def self.no_api_request?(env)
-        accept = env['HTTP_ACCEPT']
-        return false unless accept
-        accept.include?('text/html') ||
-          accept.include?('text/javascript')
-      end
     end
   end
 end

data/lib/warden/jwt_auth/hooks.rb

@@ -18,18 +18,6 @@ module Warden
         new.send(:prepare_token, user, auth, opts)
       end
 
-      # Sign out a JWT scope if it comes from the session unless it is an HTML
-      # request
-      #
-      # If a user is meant to be authenticated via JWT, then if it is fetched
-      # from the session during an API request it must be something not intended
-      # to happen and a security threat.
-      #
-      # Workaround until https://github.com/hassox/warden/pull/118 is fixed
-      def self.after_fetch(_user, auth, opts)
-        new.send(:logout_scope, auth, opts)
-      end
-
       private
 
       def prepare_token(user, auth, opts)
@@ -39,14 +27,6 @@ module Warden
         add_token_to_env(user, scope, env)
       end
 
-      # :reek:FeatureEnvy
-      def logout_scope(auth, opts)
-        env = auth.env
-        scope = opts[:scope]
-        return if !jwt_scope?(scope) || EnvHelper.no_api_request?(env)
-        auth.logout(scope)
-      end
-
       def token_should_be_added?(scope, env)
         path_info = EnvHelper.path_info(env)
         method = EnvHelper.request_method(env)
@@ -83,7 +63,3 @@ end
 Warden::Manager.after_set_user do |user, auth, opts|
   Warden::JWTAuth::Hooks.after_set_user(user, auth, opts)
 end
-
-Warden::Manager.after_fetch do |user, auth, opts|
-  Warden::JWTAuth::Hooks.after_fetch(user, auth, opts)
-end

data/lib/warden/jwt_auth/token_revoker.rb

@@ -17,6 +17,7 @@ module Warden
       # rubocop:disable Lint/HandleExceptions
       rescue JWT::ExpiredSignature
       end
+      # rubocop:enable Lint/HandleExceptions
     end
   end
 end

data/lib/warden/jwt_auth/version.rb

@@ -2,6 +2,6 @@
 
 module Warden
   module JWTAuth
-    VERSION = '0.3.4'
+    VERSION = '0.3.5'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: warden-jwt_auth
 version: !ruby/object:Gem::Version
-  version: 0.3.4
+  version: 0.3.5
 platform: ruby
 authors:
 - Marc Busqué
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2018-01-09 00:00:00.000000000 Z
+date: 2018-01-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dry-configurable