Sha256: 022040388cd1caf7ffab1c5d91fa3920a8aab7053ab72a8e1612c9a498d6ab7d
Contents?: true
Size: 1.16 KB
Versions: 16
Compression:
Stored size: 1.16 KB
Contents
require 'rack/protection'
module Rack
module Protection
##
# Prevented attack:: Session Hijacking
# Supported browsers:: all
# More infos:: http://en.wikipedia.org/wiki/Session_hijacking
#
# Tracks request properties like the user agent in the session and empties
# the session if those properties change. This essentially prevents attacks
# from Firesheep. Since all headers taken into consideration can be
# spoofed, too, this will not prevent determined hijacking attempts.
class SessionHijacking < Base
default_reaction :drop_session
default_options :tracking_key => :tracking, :encrypt_tracking => true,
:track => %w[HTTP_USER_AGENT]
def accepts?(env)
session = session env
key = options[:tracking_key]
if session.include? key
session[key].all? { |k,v| v == encrypt(env[k]) }
else
session[key] = {}
options[:track].each { |k| session[key][k] = encrypt(env[k]) }
end
end
def encrypt(value)
value = value.to_s.downcase
options[:encrypt_tracking] ? super(value) : value
end
end
end
end
Version data entries
16 entries across 13 versions & 3 rubygems