Check for nil response on JsonCsrf protection

lib/rack/protection/json_csrf.rb

@@ -19,7 +19,7 @@ def call(env)
 
         if has_vector? request, headers
           warn env, "attack prevented by #{self.class}"
-          react(env)
+          react(env) or [status, headers, body]
         else
           [status, headers, body]
         end

spec/json_csrf_spec.rb

@@ -31,6 +31,7 @@
     it "accepts XHR requests" do
       get('/', {}, 'HTTP_REFERER' => 'http://evil.com', 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest').should be_ok
     end
+
   end
 
   describe 'not json response' do
@@ -41,4 +42,18 @@
     end
 
   end
+
+  describe 'with drop_session as default reaction' do
+    it 'reset the session' do
+      mock_app do
+        use Rack::Protection, :reaction => :drop_session
+        run proc { |e| [200, {'Content-Type' => 'application/json'}, []]}
+      end
+
+      session = {:foo => :bar}
+      get('/', {}, 'HTTP_REFERER' => 'http://evil.com', 'rack.session' => session)
+      last_response.should be_ok
+      session.should be_empty
+    end
+  end
 end