Class: Safire::Middleware::HttpsOnlyRedirects

Inherits:
Faraday::Middleware
  • Object
show all
Includes:
URIValidation
Defined in:
lib/safire/middleware/https_only_redirects.rb

Overview

Faraday middleware that blocks redirects to non-HTTPS URLs.

Sits inside the follow_redirects middleware's app stack so it sees every intermediate 3xx response before the redirect is followed. HTTP redirects to localhost/127.0.0.1 are allowed only when the caller explicitly enables the local-development exception.

Instance Method Summary collapse

Constructor Details

#initialize(app, allow_insecure_localhost: false) ⇒ HttpsOnlyRedirects

Returns a new instance of HttpsOnlyRedirects.



16
17
18
19
 
# File 'lib/safire/middleware/https_only_redirects.rb', line 16

def initialize(app, allow_insecure_localhost: false)
  super(app)
  @allow_insecure_localhost = validate_localhost_policy(allow_insecure_localhost)
end

Instance Method Details

#call(env) ⇒ Object 



21
22
23
24
25
 
# File 'lib/safire/middleware/https_only_redirects.rb', line 21

def call(env)
  @app.call(env).on_complete do |response_env|
    check_redirect_safety!(response_env)
  end
end