Sha256: a0eb36bf6be47c9a972cc2ada6d77976edf1a775d55c2b1b5d6cdeffeb38bb92
Contents?: true
Size: 1.16 KB
Versions: 56
Compression:
Stored size: 1.16 KB
Contents
require 'rack/protection'
module Rack
module Protection
##
# Prevented attack:: Session Hijacking
# Supported browsers:: all
# More infos:: http://en.wikipedia.org/wiki/Session_hijacking
#
# Tracks request properties like the user agent in the session and empties
# the session if those properties change. This essentially prevents attacks
# from Firesheep. Since all headers taken into consideration might be
# spoofed, too, this will not prevent all hijacking attempts.
class SessionHijacking < Base
default_reaction :drop_session
default_options :tracking_key => :tracking, :encrypt_tracking => true,
:track => %w[HTTP_USER_AGENT HTTP_ACCEPT_ENCODING HTTP_ACCEPT_LANGUAGE]
def accepts?(env)
session = session env
key = options[:tracking_key]
if session.include? key
session[key].all? { |k,v| v == encrypt(env[k]) }
else
session[key] = {}
options[:track].each { |k| session[key][k] = encrypt(env[k]) }
end
end
def encrypt(value)
options[:encrypt_tracking] ? super(value) : value.to_s
end
end
end
end
Version data entries
56 entries across 56 versions & 4 rubygems