wai-secure-cookies 0.1.0.1 → 0.1.0.2

raw patch · 4 files changed

+14/−27 lines, 4 filesPVP ok

version bump matches the API change (PVP)

API changes (from Hackage documentation)

Files

• README.md +4/−4
• src/Cookie/Secure.hs +0/−14
• src/Cookie/Secure/Middleware.hs +9/−8
• wai-secure-cookies.cabal +1/−1

@@ -4,19 +4,19 @@  --- -** WARNING **+**WARNING**  I am not a cryptographer, and the crypto libraries in Haskell are not nearly as easy to use as what I'm used to in Ruby, so I wouldn't depend on this for a serious project until it's had some proper eyes on it.  --- -# Usage+## Usage  Populate the following environment variables in your WAI application process:  ```-WAI\_COOKIE\_VALIDATION\_KEY # key to sign cookie names and values-WAI\_COOKIE\_ENCRYPTION\_KEY # key to encrypt cookie names and values+WAI_COOKIE_VALIDATION_KEY # key to sign cookie names and values+WAI_COOKIE_ENCRYPTION_KEY # key to encrypt cookie names and values ```  You can generate random keys with `waicookie-genkey`:

@@ -1,7 +1,6 @@ module Cookie.Secure (encryptAndSign                     , verifyAndDecrypt                     , encryptAndSignIO-                    , encryptNullIVAndSignIO                     , verifyAndDecryptIO) where  import Data.ByteString (ByteString)@@ -49,19 +48,6 @@    throwCryptoErrorIO     $ encryptAndSign iv encryptionKey validationKey message---- OPTIMIZE: DRY this up.-encryptNullIVAndSignIO :: ByteString -> IO ByteString-encryptNullIVAndSignIO message = do-  -- This is currently ignored and a null IV used in its place, because we-  -- need a deterministic output for cookies to be removed or changed, and-  -- a random IV breaks that.-  (_, validationKey, encryptionKey) <- getIVAuthKeyEncryptKey--  throwCryptoErrorIO-    $ encryptAndSign nullStringIV encryptionKey validationKey message-    where-      nullStringIV = replicate 16 '\0'  verifyAndDecryptIO :: ByteString -> IO (Maybe ByteString) verifyAndDecryptIO message = do

@@ -15,7 +15,7 @@ import Network.HTTP.Types.Status (status200) import qualified Data.ByteString.Char8 as BS import Data.Maybe (catMaybes)-import Cookie.Secure (encryptNullIVAndSignIO, verifyAndDecryptIO)+import Cookie.Secure (encryptAndSignIO, verifyAndDecryptIO) import Data.List.Split (splitOn)  secureCookies :: Middleware@@ -49,13 +49,14 @@       (cookie, metadata) = BS.break (== ';') value       encryptedSignedCookieHeaderValue =         flip BS.append metadata <$> encryptAndSignCookie cookie-      encryptAndSignCookie c =-        BS.intercalate "="-        -- OPTIMIZE: Use IV for value, but not name, so that the cookie-        -- can actually be deleted while keeping the value as secure as-        -- possible.-        <$> mapM encryptNullIVAndSignIO-        (map BS.pack (splitOn "=" (BS.unpack c)))+      encryptAndSignCookie c = do+        let cookieNameValueList = map BS.pack . splitOn "=" $ BS.unpack c+        let cName = head cookieNameValueList+        let cValue = last cookieNameValueList++        encryptedValue <- encryptAndSignIO cValue++        return $ BS.intercalate "=" [cName, encryptedValue]  replaceRequestHeaders :: Request -> RequestHeaders -> Request replaceRequestHeaders request newHeaders =

@@ -1,5 +1,5 @@ name:                wai-secure-cookies-version:             0.1.0.1+version:             0.1.0.2 description:         WAI middleware to automatically encrypt and sign cookies homepage:            https://github.com/habibalamin/wai-secure-cookies license:             MIT