Object
# File lib/rack/ssl.rb, line 8 8: def self.default_hsts_options 9: { :expires => YEAR, :subdomains => false } 10: end
# File lib/rack/ssl.rb, line 12 12: def initialize(app, options = {}) 13: @app = app 14: 15: @hsts = options[:hsts] 16: @hsts = {} if @hsts.nil? || @hsts == true 17: @hsts = self.class.default_hsts_options.merge(@hsts) if @hsts 18: 19: @exclude = options[:exclude] 20: @host = options[:host] 21: end
# File lib/rack/ssl.rb, line 23 23: def call(env) 24: if @exclude && @exclude.call(env) 25: @app.call(env) 26: elsif scheme(env) == 'https' 27: status, headers, body = @app.call(env) 28: headers = hsts_headers.merge(headers) 29: flag_cookies_as_secure!(headers) 30: [status, headers, body] 31: else 32: redirect_to_https(env) 33: end 34: end
tools.ietf.org/html/draft-hodges-strict-transport-sec-02
# File lib/rack/ssl.rb, line 60 60: def hsts_headers 61: if @hsts 62: value = "max-age=#{@hsts[:expires]}" 63: value += "; includeSubDomains" if @hsts[:subdomains] 64: { 'Strict-Transport-Security' => value } 65: else 66: {} 67: end 68: end
# File lib/rack/ssl.rb, line 48 48: def redirect_to_https(env) 49: req = Request.new(env) 50: url = URI(req.url) 51: url.scheme = "https" 52: url.host = @host if @host 53: headers = hsts_headers.merge('Content-Type' => 'text/html', 54: 'Location' => url.to_s) 55: 56: [301, headers, []] 57: end
Disabled; run with --debug to generate this.
Generated with the Darkfish Rdoc Generator 1.1.6.