Permalink
Browse files

Only send secure cookies over SSL.

  • Loading branch information...
loe authored and tenderlove committed Sep 13, 2010
1 parent 0522b26 commit 9cd094b8da492b711002dd4b1f2792f315e9bde0
@@ -152,6 +152,10 @@ def call(env)
options = env[ENV_SESSION_OPTIONS_KEY]
if !session_data.is_a?(AbstractStore::SessionHash) || session_data.loaded? || options[:expire_after]
+ request = ActionDispatch::Request.new(env)
+
+ return response if (options[:secure] && !request.ssl?)
+
session_data.send(:load!) if session_data.is_a?(AbstractStore::SessionHash) && !session_data.loaded?
sid = options[:id] || generate_sid
@@ -165,7 +169,6 @@ def call(env)
cookie[:expires] = Time.now + options.delete(:expire_after)
end
- request = ActionDispatch::Request.new(env)
set_cookie(request, cookie.merge!(options))
end
@@ -47,6 +47,11 @@ def authenticate_with_http_only
cookies["user_name"] = { :value => "david", :httponly => true }
head :ok
end
+
+ def authenticate_with_secure
+ cookies["user_name"] = { :value => "david", :secure => true }
+ head :ok
+ end
def set_permanent_cookie
cookies.permanent[:user_name] = "Jamie"
@@ -128,6 +133,12 @@ def test_setting_cookie_with_http_only
assert_cookie_header "user_name=david; path=/; HttpOnly"
assert_equal({"user_name" => "david"}, @response.cookies)
end
+
+ def test_setting_cookie_with_secure
+ get :authenticate_with_secure
+ assert_cookie_header "user_name=david; path=/; secure"
+ assert_equal({"user_name" => "david"}, @response.cookies)
+ end
def test_multiple_cookies
get :set_multiple_cookies
@@ -105,6 +105,23 @@ def test_disregards_tampered_sessions
assert_equal 'foo: nil', response.body
end
end
+
+ def test_does_not_set_secure_cookies_over_http
+ with_test_route_set(:secure => true) do
+ get '/set_session_value'
+ assert_response :success
+ assert_equal nil, headers['Set-Cookie']
+ end
+ end
+
+ def test_does_set_secure_cookies_over_https
+ with_test_route_set(:secure => true) do
+ get '/set_session_value', nil, 'HTTPS' => 'on'
+ assert_response :success
+ assert_equal "_myapp_session=#{response.body}; path=/; secure; HttpOnly",
+ headers['Set-Cookie']
+ end
+ end
# {:foo=>#<SessionAutoloadTest::Foo bar:"baz">, :session_id=>"ce8b0752a6ab7c7af3cdb8a80e6b9e46"}
SignedSerializedCookie = "BAh7BzoIZm9vbzodU2Vzc2lvbkF1dG9sb2FkVGVzdDo6Rm9vBjoJQGJhciIIYmF6Og9zZXNzaW9uX2lkIiVjZThiMDc1MmE2YWI3YzdhZjNjZGI4YTgwZTZiOWU0Ng==--2bf3af1ae8bd4e52b9ac2099258ace0c380e601c"

0 comments on commit 9cd094b

Please sign in to comment.