Class: Aker::Rack::Logout

Inherits:
Object
  • Object
show all
Includes:
ConfigurationHelper
Defined in:
lib/aker/rack/logout.rb

Overview

Middleware for ending authenticated sessions. This middleware listens for GET requests to the logout path and when such requests are received, clears user data.

The logout path is /logout by default. It may be overridden in the Aker configuration by setting a value for :logout_path in the :rack parameter group.

Implications of GET

GET was chosen to ensure that there always exists a way to clear application session data independent of whether it is possible to get to a logout link. (If unmarshalable data exists in the session -- say, stored objects whose format has changed between application revisions -- it is possible to get into a state where logout links cannot be accessed.)

Using GET does mean that it is possible to execute CSRF attacks that will log out the user. The severity of this can range from a minor annoyance (just having to log in again while browsing a series of pages) to major (losing all data in a large POST).

See Also:

Instance Method Summary collapse

Methods included from ConfigurationHelper

#login_path, #logout_path

Methods included from EnvironmentHelper

#authority, #configuration, #interactive?

Constructor Details

#initialize(app) ⇒ Logout

Instantiates the middleware.

Parameters:

  • app (Rack app) —

    the Rack application on which this middleware should be layered



38
39
40
 
# File 'lib/aker/rack/logout.rb', line 38

def initialize(app)
  @app = app
end

Instance Method Details

#call(env) ⇒ Array

When given a GET for the configured logout path, invokes Warden's logout procedure (which resets the session), and passes control down to the rest of the application.

If the application or a mode does not provide a handler for the configured logout path, then the handler defined by DefaultLogoutResponder will be invoked.

Parameters:

  • env (Hash) —

    a Rack environment

Returns:

  • (Array) —

    a finished Rack response

See Also:



54
55
56
57
58
59
60
 
# File 'lib/aker/rack/logout.rb', line 54

def call(env)
  if env['REQUEST_METHOD'] == 'GET' && env['PATH_INFO'] == logout_path(env)
    env['warden'].logout
  end

  @app.call(env)
end