mirror of
https://github.com/sinatra/sinatra
synced 2023-03-27 23:18:01 -04:00
2ccd0dc29d
* Allow running with Rack 3. * Pull in `rack-session` gem if needed. * Try again. * Use separate gemfiles for testing. * Better test titles. * Fix dependency on rack-test. * Add rackup gem. * Fix server registration. * Update rack version constraints Co-authored-by: Jordan Owens <jkowens@gmail.com> |
||
|---|---|---|
| .. | ||
| lib | ||
| spec | ||
| .gitignore | ||
| .rspec | ||
| Gemfile | ||
| License | ||
| rack-protection.gemspec | ||
| Rakefile | ||
| README.md | ||
Rack::Protection
This gem protects against typical web attacks. Should work for all Rack apps, including Rails.
Usage
Use all protections you probably want to use:
# config.ru
require 'rack/protection'
use Rack::Protection
run MyApp
Skip a single protection middleware:
# config.ru
require 'rack/protection'
use Rack::Protection, :except => :path_traversal
run MyApp
Use a single protection middleware:
# config.ru
require 'rack/protection'
use Rack::Protection::AuthenticityToken
run MyApp
Prevented Attacks
Cross Site Request Forgery
Prevented by:
Rack::Protection::AuthenticityToken(not included byuse Rack::Protection)Rack::Protection::FormToken(not included byuse Rack::Protection)Rack::Protection::JsonCsrfRack::Protection::RemoteReferrer(not included byuse Rack::Protection)Rack::Protection::RemoteTokenRack::Protection::HttpOrigin
Cross Site Scripting
Prevented by:
Rack::Protection::EscapedParams(not included byuse Rack::Protection)Rack::Protection::XSSHeader(Internet Explorer and Chrome only)Rack::Protection::ContentSecurityPolicy
Clickjacking
Prevented by:
Directory Traversal
Prevented by:
Session Hijacking
Prevented by:
Cookie Tossing
Prevented by:
Rack::Protection::CookieTossing(not included byuse Rack::Protection)
IP Spoofing
Prevented by:
Helps to protect against protocol downgrade attacks and cookie hijacking
Prevented by:
Rack::Protection::StrictTransport(not included byuse Rack::Protection)
Installation
gem install rack-protection
Instrumentation
Instrumentation is enabled by passing in an instrumenter as an option.
use Rack::Protection, instrumenter: ActiveSupport::Notifications
The instrumenter is passed a namespace (String) and environment (Hash). The namespace is 'rack.protection' and the attack type can be obtained from the environment key 'rack.protection.attack'.