Contents

module Spontaneous::Rack::Middleware
  module CSRF
    # Creates and inserts CSRF tokens into Rack env
    # If token is present then it validates it and adds the validation
    # status to the `env`. If it isn't present then one is created
    # passed into the `env` and the validation flag is unset
    #
    # This depends on the presences of an AccessKey in the `env`
    class Header
      include Spontaneous::Rack::Constants

      def initialize(app)
        @app = app
      end

      def call(env)
        if (key = env[ACTIVE_KEY])
          token = load_token(env)
          call!(env, key, token)
        else
          # Should never happen as authentication should be enforced further up
          # the stack
          [401, {}, ["Unauthorised"]]
        end
      end

      def load_token(env)
        header_token(env) || param_token(env)
      end

      def header_token(env)
        env[CSRF_ENV]
      end

      def param_token(env)
        request = ::Rack::Request.new(env)
        request.params[CSRF_PARAM]
      end

      def call!(env, key, token)
        valid = valid?(key, token)
        token ||= key.generate_csrf_token
        @app.call(env.merge(CSRF_VALID => valid, CSRF_TOKEN => token))
      end

      def valid?(key, token)
        key.csrf_token_valid?(token)
      end
    end

    # Provides CSRF verification for requests. Relies upon the Header
    # app to insert the validation step.
    class Verification
      include Spontaneous::Rack::Constants

      def initialize(app)
        @app = app
      end

      def call(env)
        return [401, {}, ["Unauthorised"]] unless env[CSRF_VALID]
        @app.call(env)
      end
    end
  end
end

Version data entries

9 entries across 9 versions & 1 rubygems

Version	Path
spontaneous-0.2.0.beta10	lib/spontaneous/rack/middleware/csrf.rb
spontaneous-0.2.0.beta9	lib/spontaneous/rack/middleware/csrf.rb
spontaneous-0.2.0.beta8	lib/spontaneous/rack/middleware/csrf.rb
spontaneous-0.2.0.beta7	lib/spontaneous/rack/middleware/csrf.rb
spontaneous-0.2.0.beta6	lib/spontaneous/rack/middleware/csrf.rb
spontaneous-0.2.0.beta5	lib/spontaneous/rack/middleware/csrf.rb
spontaneous-0.2.0.beta4	lib/spontaneous/rack/middleware/csrf.rb
spontaneous-0.2.0.beta3	lib/spontaneous/rack/middleware/csrf.rb
spontaneous-0.2.0.beta2	lib/spontaneous/rack/middleware/csrf.rb