In Files

Parent

Class Index [+]

Quicksearch

Rack::SSL

Constants

YEAR

Public Class Methods

default_hsts_options() click to toggle source
    # File lib/rack/ssl.rb, line 8
 8:     def self.default_hsts_options
 9:       { :expires => YEAR, :subdomains => false }
10:     end
new(app, options = {}) click to toggle source
    # File lib/rack/ssl.rb, line 12
12:     def initialize(app, options = {})
13:       @app = app
14: 
15:       @hsts = options[:hsts]
16:       @hsts = {} if @hsts.nil? || @hsts == true
17:       @hsts = self.class.default_hsts_options.merge(@hsts) if @hsts
18: 
19:       @exclude = options[:exclude]
20:       @host    = options[:host]
21:     end

Public Instance Methods

call(env) click to toggle source
    # File lib/rack/ssl.rb, line 23
23:     def call(env)
24:       if @exclude && @exclude.call(env)
25:         @app.call(env)
26:       elsif scheme(env) == 'https'
27:         status, headers, body = @app.call(env)
28:         headers = hsts_headers.merge(headers)
29:         flag_cookies_as_secure!(headers)
30:         [status, headers, body]
31:       else
32:         redirect_to_https(env)
33:       end
34:     end

Private Instance Methods

flag_cookies_as_secure!(headers) click to toggle source
    # File lib/rack/ssl.rb, line 70
70:       def flag_cookies_as_secure!(headers)
71:         if cookies = headers['Set-Cookie']
72:           # Rack 1.1's set_cookie_header! will sometimes wrap
73:           # Set-Cookie in an array
74:           unless cookies.respond_to?(:to_ary)
75:             cookies = cookies.split("\n")
76:           end
77: 
78:           headers['Set-Cookie'] = cookies.map { |cookie|
79:             if cookie !~ /; secure(;|$)/
80:               "#{cookie}; secure"
81:             else
82:               cookie
83:             end
84:           }.join("\n")
85:         end
86:       end
hsts_headers() click to toggle source

tools.ietf.org/html/draft-hodges-strict-transport-sec-02

    # File lib/rack/ssl.rb, line 60
60:       def hsts_headers
61:         if @hsts
62:           value = "max-age=#{@hsts[:expires]}"
63:           value += "; includeSubDomains" if @hsts[:subdomains]
64:           { 'Strict-Transport-Security' => value }
65:         else
66:           {}
67:         end
68:       end
redirect_to_https(env) click to toggle source
    # File lib/rack/ssl.rb, line 48
48:       def redirect_to_https(env)
49:         req        = Request.new(env)
50:         url        = URI(req.url)
51:         url.scheme = "https"
52:         url.host   = @host if @host
53:         headers    = hsts_headers.merge('Content-Type' => 'text/html',
54:                                         'Location'     => url.to_s)
55: 
56:         [301, headers, []]
57:       end
scheme(env) click to toggle source

Fixed in rack >= 1.3

    # File lib/rack/ssl.rb, line 38
38:       def scheme(env)
39:         if env['HTTPS'] == 'on'
40:           'https'
41:         elsif env['HTTP_X_FORWARDED_PROTO']
42:           env['HTTP_X_FORWARDED_PROTO'].split(',')[0]
43:         else
44:           env['rack.url_scheme']
45:         end
46:       end

Disabled; run with --debug to generate this.

[Validate]

Generated with the Darkfish Rdoc Generator 1.1.6.