Code

Handle very dynamic policies better#232

Code

Merged

oreoshake merged 22 commits intomastergithub/secure_headers:masterfrom single-idempotency-checkgithub/secure_headers:single-idempotency-checkCopy head branch name to clipboardMar 26, 2016

+207-155

Commits

Commits on Mar 15, 2016

• Only perform idempotency check once per request, only bust CSP cache on changes

  oreoshake

  committed
  393960b

  Copy full SHA for 393960b

• cached_headers will always contain the desired values

  oreoshake

  committed
  9ffd52f

  Copy full SHA for 9ffd52f

• merge! call can be replaced with merge

  oreoshake

  committed
  c723aa3

  Copy full SHA for c723aa3

Commits on Mar 16, 2016

• Merge branch 'master' into single-idempotency-check

  oreoshake

  committed
  2c72ff7

  Copy full SHA for 2c72ff7

• handle dup'ing the secure_cookies config value

  oreoshake

  committed
  3555996

  Copy full SHA for 3555996

• there is no reason to deep dup config values since we can assume the configs we are modifying are dups of the originals

  oreoshake

  committed
  c965ad8

  Copy full SHA for c965ad8

• move cache management code for xframeoptions inside Configuration class. make cached_headers an attr_reader again

  oreoshake

  committed
  437f604

  Copy full SHA for 437f604

• mark cached_headers setter method as protected to avoid a send call

  oreoshake

  committed
  15258b1

  Copy full SHA for 15258b1

• cleanup API visibility a little

  oreoshake

  committed
  89ba87e

  Copy full SHA for 89ba87e

• ensure that headers other than xfo/csp can bypassed for a given request (and the cache is updated)

  oreoshake

  committed
  4d2b8e7

  Copy full SHA for 4d2b8e7

• update header cache directly rather than updating config values (except CSP)

  oreoshake

  committed
  621da3b

  Copy full SHA for 621da3b

Commits on Mar 17, 2016

• to_s was hiding a potential bug

  oreoshake

  committed
  15791ed

  Copy full SHA for 15791ed

• use deep_copy in CombinePolicies just in case

  oreoshake

  committed
  79e1eb1

  Copy full SHA for 79e1eb1

Commits on Mar 22, 2016

• add test ensuring that appending/overriding config dups a global policy once, and modifies a local policy on subsequent modifications

  oreoshake

  committed
  bda2b58

  Copy full SHA for bda2b58

• use let construct instead of an ivar for the request object

  oreoshake

  committed
  2aa51ea

  Copy full SHA for 2aa51ea

• whitespace

  oreoshake

  committed
  20ec917

  Copy full SHA for 20ec917

• inline one-time use variable

  oreoshake

  committed
  e1b4b59

  Copy full SHA for e1b4b59

• no need to namespace the Configuration class

  oreoshake

  committed
  fb07247

  Copy full SHA for fb07247

• add test statements showing env is void of a config

  oreoshake

  committed
  00ce0c1

  Copy full SHA for 00ce0c1

• add test clause ensuring that idempotent_additions? is only called once

  oreoshake

  committed
  7e16537

  Copy full SHA for 7e16537

• add expectation that overriding the config stores the expected instance in env

  oreoshake

  committed
  8a314e1

  Copy full SHA for 8a314e1

Commits on Mar 23, 2016

• prevent the ability to muck with original CSP settings when using a dynamic policy

  Show description for cbe7014
  oreoshake

  committed
  cbe7014

  Copy full SHA for cbe7014