kotovalexarian-likes-github
/
sinatra
mirror of https://github.com/sinatra/sinatra
1
0
Fork 0
Code Releases Activity
sinatra/rack-protection
History
Konstantin Haase 65cf3fd59b rework protection headers, fixes #40 2013-03-01 15:36:05 +11:00
..
lib rework protection headers, fixes #40 2013-03-01 15:36:05 +11:00
spec rework protection headers, fixes #40 2013-03-01 15:36:05 +11:00
.gitignore ignore Gemfile.lock 2011-09-30 15:50:51 -05:00
.travis.yml Revert "Update .travis.yml" 2012-12-12 13:46:51 +01:00
Gemfile improve compatibility to old rack versions, fixes #36 2012-12-12 11:03:07 +01:00
License initial commit 2011-05-23 10:07:54 +02:00
README.md fix docs 2012-12-12 23:40:22 +01:00
Rakefile escape unicode in gemspec, fixes #35 2012-12-12 10:22:30 +01:00
rack-protection.gemspec escape unicode in gemspec, fixes #35 2012-12-12 10:22:30 +01:00

README.md

You should use protection!

This gem protects against typical web attacks. Should work for all Rack apps, including Rails.

Usage

Use all protections you probably want to use:

# config.ru
require 'rack/protection'
use Rack::Protection
run MyApp

Skip a single protection middleware:

# config.ru
require 'rack/protection'
use Rack::Protection, :except => :path_traversal
run MyApp

Use a single protection middleware:

# config.ru
require 'rack/protection'
use Rack::Protection::AuthenticityToken
run MyApp

Prevented Attacks

Cross Site Request Forgery

Prevented by:

  • Rack::Protection::AuthenticityToken (not included by use Rack::Protection)
  • Rack::Protection::FormToken (not included by use Rack::Protection)
  • Rack::Protection::JsonCsrf
  • Rack::Protection::RemoteReferrer (not included by use Rack::Protection)
  • Rack::Protection::RemoteToken
  • Rack::Protection::HttpOrigin

Cross Site Scripting

Prevented by:

  • Rack::Protection::EscapedParams (not included by use Rack::Protection)
  • Rack::Protection::XSSHeader (Internet Explorer only)

Clickjacking

Prevented by:

  • Rack::Protection::FrameOptions

Directory Traversal

Prevented by:

  • Rack::Protection::PathTraversal

Session Hijacking

Prevented by:

  • Rack::Protection::SessionHijacking

IP Spoofing

Prevented by:

  • Rack::Protection::IPSpoofing

Installation

gem install rack-protection