/usr/share/doc/ruby-rack-protection/README.md is in ruby-rack-protection 1.5.3-2.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 | You should use protection!
This gem protects against typical web attacks.
Should work for all Rack apps, including Rails.
# Usage
Use all protections you probably want to use:
``` ruby
# config.ru
require 'rack/protection'
use Rack::Protection
run MyApp
```
Skip a single protection middleware:
``` ruby
# config.ru
require 'rack/protection'
use Rack::Protection, :except => :path_traversal
run MyApp
```
Use a single protection middleware:
``` ruby
# config.ru
require 'rack/protection'
use Rack::Protection::AuthenticityToken
run MyApp
```
# Prevented Attacks
## Cross Site Request Forgery
Prevented by:
* `Rack::Protection::AuthenticityToken` (not included by `use Rack::Protection`)
* `Rack::Protection::FormToken` (not included by `use Rack::Protection`)
* `Rack::Protection::JsonCsrf`
* `Rack::Protection::RemoteReferrer` (not included by `use Rack::Protection`)
* `Rack::Protection::RemoteToken`
* `Rack::Protection::HttpOrigin`
## Cross Site Scripting
Prevented by:
* `Rack::Protection::EscapedParams` (not included by `use Rack::Protection`)
* `Rack::Protection::XSSHeader` (Internet Explorer only)
## Clickjacking
Prevented by:
* `Rack::Protection::FrameOptions`
## Directory Traversal
Prevented by:
* `Rack::Protection::PathTraversal`
## Session Hijacking
Prevented by:
* `Rack::Protection::SessionHijacking`
## IP Spoofing
Prevented by:
* `Rack::Protection::IPSpoofing`
# Installation
gem install rack-protection
# Instrumentation
Instrumentation is enabled by passing in an instrumenter as an option.
```
use Rack::Protection, instrumenter: ActiveSupport::Notifications
```
The instrumenter is passed a namespace (String) and environment (Hash). The namespace is 'rack.protection' and the attack type can be obtained from the environment key 'rack.protection.attack'.
|