Sha256: e822ae88cd035b8d31a691f684ceb36723f95b24d090d722f45e0e8ca9a4d9de
Contents?: true
Size: 1.19 KB
Versions: 27
Compression:
Stored size: 1.19 KB
Contents
require 'rack/protection'
module Rack
module Protection
##
# Prevented attack:: Session Hijacking
# Supported browsers:: all
# More infos:: http://en.wikipedia.org/wiki/Session_hijacking
#
# Tracks request properties like the user agent in the session and empties
# the session if those properties change. This essentially prevents attacks
# from Firesheep. Since all headers taken into consideration might be
# spoofed, too, this will not prevent all hijacking attempts.
class SessionHijacking < Base
default_reaction :drop_session
default_options :tracking_key => :tracking, :encrypt_tracking => true,
:track => %w[HTTP_USER_AGENT HTTP_ACCEPT_ENCODING HTTP_ACCEPT_LANGUAGE]
def accepts?(env)
session = session env
key = options[:tracking_key]
if session.include? key
session[key].all? { |k,v| v == encrypt(env[k]) }
else
session[key] = {}
options[:track].each { |k| session[key][k] = encrypt(env[k]) }
end
end
def encrypt(value)
value = value.to_s.downcase
options[:encrypt_tracking] ? super(value) : value
end
end
end
end
Version data entries
27 entries across 25 versions & 4 rubygems