-
Notifications
You must be signed in to change notification settings - Fork 218
Expand file tree
/
Copy pathrack-protection-readme.html
More file actions
124 lines (82 loc) · 4.99 KB
/
rack-protection-readme.html
File metadata and controls
124 lines (82 loc) · 4.99 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
<h1 id="usage">Usage</h1>
<p>Use all protections you probably want to use:</p>
<div class="language-ruby highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c1"># config.ru</span>
<span class="nb">require</span> <span class="s1">'rack/protection'</span>
<span class="n">use</span> <span class="no">Rack</span><span class="o">::</span><span class="no">Protection</span>
<span class="n">run</span> <span class="no">MyApp</span>
</code></pre></div></div>
<p>Skip a single protection middleware:</p>
<div class="language-ruby highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c1"># config.ru</span>
<span class="nb">require</span> <span class="s1">'rack/protection'</span>
<span class="n">use</span> <span class="no">Rack</span><span class="o">::</span><span class="no">Protection</span><span class="p">,</span> <span class="ss">:except</span> <span class="o">=></span> <span class="ss">:path_traversal</span>
<span class="n">run</span> <span class="no">MyApp</span>
</code></pre></div></div>
<p>Use a single protection middleware:</p>
<div class="language-ruby highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c1"># config.ru</span>
<span class="nb">require</span> <span class="s1">'rack/protection'</span>
<span class="n">use</span> <span class="no">Rack</span><span class="o">::</span><span class="no">Protection</span><span class="o">::</span><span class="no">AuthenticityToken</span>
<span class="n">run</span> <span class="no">MyApp</span>
</code></pre></div></div>
<h1 id="prevented-attacks">Prevented Attacks</h1>
<h2 id="cross-site-request-forgery">Cross Site Request Forgery</h2>
<p>Prevented by:</p>
<ul>
<li>
<a href="http://www.sinatrarb.com/protection/authenticity_token"><code>Rack::Protection::AuthenticityToken</code></a> (not included by <code>use Rack::Protection</code>)</li>
<li>
<a href="http://www.sinatrarb.com/protection/form_token"><code>Rack::Protection::FormToken</code></a> (not included by <code>use Rack::Protection</code>)</li>
<li><a href="http://www.sinatrarb.com/protection/json_csrf"><code>Rack::Protection::JsonCsrf</code></a></li>
<li>
<a href="http://www.sinatrarb.com/protection/remote_referrer"><code>Rack::Protection::RemoteReferrer</code></a> (not included by <code>use Rack::Protection</code>)</li>
<li><a href="http://www.sinatrarb.com/protection/remote_token"><code>Rack::Protection::RemoteToken</code></a></li>
<li><a href="http://www.sinatrarb.com/protection/http_origin"><code>Rack::Protection::HttpOrigin</code></a></li>
</ul>
<h2 id="cross-site-scripting">Cross Site Scripting</h2>
<p>Prevented by:</p>
<ul>
<li>
<a href="http://www.sinatrarb.com/protection/escaped_params"><code>Rack::Protection::EscapedParams</code></a> (not included by <code>use Rack::Protection</code>)</li>
<li>
<a href="http://www.sinatrarb.com/protection/xss_header"><code>Rack::Protection::XSSHeader</code></a> (Internet Explorer and Chrome only)</li>
<li><a href="http://www.sinatrarb.com/protection/content_security_policy"><code>Rack::Protection::ContentSecurityPolicy</code></a></li>
</ul>
<h2 id="clickjacking">Clickjacking</h2>
<p>Prevented by:</p>
<ul>
<li><a href="http://www.sinatrarb.com/protection/frame_options"><code>Rack::Protection::FrameOptions</code></a></li>
</ul>
<h2 id="directory-traversal">Directory Traversal</h2>
<p>Prevented by:</p>
<ul>
<li><a href="http://www.sinatrarb.com/protection/path_traversal"><code>Rack::Protection::PathTraversal</code></a></li>
</ul>
<h2 id="session-hijacking">Session Hijacking</h2>
<p>Prevented by:</p>
<ul>
<li><a href="http://www.sinatrarb.com/protection/session_hijacking"><code>Rack::Protection::SessionHijacking</code></a></li>
</ul>
<h2 id="cookie-tossing">Cookie Tossing</h2>
<p>Prevented by:</p>
<ul>
<li>
<a href="http://www.sinatrarb.com/protection/cookie_tossing"><code>Rack::Protection::CookieTossing</code></a> (not included by <code>use Rack::Protection</code>)</li>
</ul>
<h2 id="ip-spoofing">IP Spoofing</h2>
<p>Prevented by:</p>
<ul>
<li><a href="http://www.sinatrarb.com/protection/ip_spoofing"><code>Rack::Protection::IPSpoofing</code></a></li>
</ul>
<h2 id="helps-to-protect-against-protocol-downgrade-attacks-and-cookie-hijacking">Helps to protect against protocol downgrade attacks and cookie hijacking</h2>
<p>Prevented by:</p>
<ul>
<li>
<a href="http://www.sinatrarb.com/protection/strict_transport"><code>Rack::Protection::StrictTransport</code></a> (not included by <code>use Rack::Protection</code>)</li>
</ul>
<h1 id="installation">Installation</h1>
<pre><code>gem install rack-protection
</code></pre>
<h1 id="instrumentation">Instrumentation</h1>
<p>Instrumentation is enabled by passing in an instrumenter as an option.</p>
<pre><code>use Rack::Protection, instrumenter: ActiveSupport::Notifications
</code></pre>
<p>The instrumenter is passed a namespace (String) and environment (Hash). The namespace is ‘rack.protection’ and the attack type can be obtained from the environment key ‘rack.protection.attack’.</p>