kotovalexarian-likes-github
/
sinatra
mirror of https://github.com/sinatra/sinatra
1
0
Fork 0
Code Releases Activity
sinatra/rack-protection
History
Florian Gilcher 3835ec3ea8 Add a `report` reaction 
This reaction does not halt the request, but leaves it up to the
app to react on this information. This allows e.g. frameworks to
ignore failures in certain conditions.
 		2013-03-10 23:34:37 +01:00
..
lib Add a `report` reaction 2013-03-10 23:34:37 +01:00
spec Add a `report` reaction 2013-03-10 23:34:37 +01:00
.gitignore ignore Gemfile.lock 2011-09-30 15:50:51 -05:00
.travis.yml Revert "Update .travis.yml" 2012-12-12 13:46:51 +01:00
Gemfile improve compatibility to old rack versions, fixes #36 2012-12-12 11:03:07 +01:00
License initial commit 2011-05-23 10:07:54 +02:00
README.md fix docs 2012-12-12 23:40:22 +01:00
Rakefile v1.4.0 2013-03-01 15:55:54 +11:00
rack-protection.gemspec v1.4.0 2013-03-01 15:55:54 +11:00

README.md

You should use protection!

This gem protects against typical web attacks. Should work for all Rack apps, including Rails.

Usage

Use all protections you probably want to use:

# config.ru
require 'rack/protection'
use Rack::Protection
run MyApp

Skip a single protection middleware:

# config.ru
require 'rack/protection'
use Rack::Protection, :except => :path_traversal
run MyApp

Use a single protection middleware:

# config.ru
require 'rack/protection'
use Rack::Protection::AuthenticityToken
run MyApp

Prevented Attacks

Cross Site Request Forgery

Prevented by:

  • Rack::Protection::AuthenticityToken (not included by use Rack::Protection)
  • Rack::Protection::FormToken (not included by use Rack::Protection)
  • Rack::Protection::JsonCsrf
  • Rack::Protection::RemoteReferrer (not included by use Rack::Protection)
  • Rack::Protection::RemoteToken
  • Rack::Protection::HttpOrigin

Cross Site Scripting

Prevented by:

  • Rack::Protection::EscapedParams (not included by use Rack::Protection)
  • Rack::Protection::XSSHeader (Internet Explorer only)

Clickjacking

Prevented by:

  • Rack::Protection::FrameOptions

Directory Traversal

Prevented by:

  • Rack::Protection::PathTraversal

Session Hijacking

Prevented by:

  • Rack::Protection::SessionHijacking

IP Spoofing

Prevented by:

  • Rack::Protection::IPSpoofing

Installation

gem install rack-protection