http-protection

This library protects against typical web attacks. It was inspired in rack-protection Ruby gem.

Installation

Add this to your application's shard.yml:

dependencies:
  http-protection:
    github: rogeriozambon/http-protection

Usage

require "http/server"
require "http-protection"

server = HTTP::Server.new([
  HTTP::Protection::Deflect.new,
  HTTP::Protection::FrameOptions.new,
  HTTP::Protection::IpSpoofing.new,
  HTTP::Protection::Origin.new,
  HTTP::Protection::PathTraversal.new,
  HTTP::Protection::RemoteReferer.new,
  HTTP::Protection::StrictTransport.new,
  HTTP::Protection::XSSHeader.new
])

server.bind_tcp "0.0.0.0", 8080
server.listen

Deflect middleware

It protects against Denial-of-service attacks. You can define a several options for this middleware.

| Option | Description | Default value | Type | | --------- | ----------------------------------------------------------- | ------------- | ------------- | | interval | Duration in seconds until the request counter is reset. | 5 | Int32 | | duration | Duration in seconds that a remote address will be blocked. | 900 | Int32 | | threshold | Number of requests allowed. | 100 | Int32 | | blacklist | Array of remote addresses immediately considered malicious. | [] | Array(String) | | whitelist | Array of remote addresses which bypass Deflect. | [] | Array(String) |

Example:

HTTP::Protection::Deflect.new(
  interval: 5,
  duration: 5,
  threshold: 10,
  blacklist: ["111.111.111.111"],
  whitelist: ["222.222.222.222"]
)

FrameOptions middleware

It protects against clickjacking, setting header to tell the browser avoid embedding the page in a frame. You can define one option for this middleware.

| Option | Description | Default value | Type | | ------ | --------------------------------------------------------------------------------------- | ------------- | ------ | | option | Defines who should be allowed to embed the page in a frame. Use "DENY" or "SAMEORIGIN". | SAMEORIGIN | String |

Example:

HTTP::Protection::FrameOptions.new(option: "SAMEORIGIN")

IpSpoofing middleware

It detects IP spoofing attacks.

Example:

HTTP::Protection::IpSpoofing.new

Origin middleware

It protects against unsafe HTTP requests when value of Origin HTTP request header doesn't match default or whitelisted URIs. You can define the whitelist of URIs.

| Option | Description | Default value | Type | | --------- | --------------------- | ------------- | ------------- | | whitelist | Array of allowed URIs | [] | Array(String) |

Example:

HTTP::Protection::Origin.new(whitelist: ["http://friend.com"])

PathTraversal middleware

It protects against unauthorized access to file system attacks, unescapes '/' and '.' from PATH_INFO.

Example:

HTTP::Protection::PathTraversal.new

RemoteReferer middleware

It doesn't accept unsafe HTTP requests if the Referer header is set to a different host. You can define the HTTP methods that are allowed.

| Option | Description | Default value | Type | | ------- | ----------------------------------------- | ------------------------- | ------------- | | methods | Defines which HTTP method should be used. | GET, HEAD, OPTIONS, TRACE | Array(String) |

Example:

HTTP::Protection::RemoteReferer.new(methods: ["GET"])

StrictTransport middleware

It protects against protocol downgrade attacks and cookie hijacking. You can define some options for this middleware.

| Option | Description | Default value | Type | | ------------------ | ------------------------------------------------------------------------- | ------------- | ----- | | max_age | How long future requests to the domain should go over HTTPS (in seconds). | 31536000 | Int32 | | include_subdomains | If all present and future subdomains will be HTTPS. | false | Bool | | preload | Allow this domain to be included in browsers HSTS preload list. | false | Bool |

Example:

HTTP::Protection::StrictTransport.new(
  max_age: 31536000,
  include_subdomains: false,
  preload: false
)

XSSHeader middleware

It sets X-XSS-Protection header to tell the browser to block attacks. XSS vulnerabilities enable an attacker to control the relationship between a user and a web site or web application that they trust.

You can define some options for this middleware.

| Option | Description | Default value | Type | | -------- | -------------------------------------------------------------- | ------------- | ------ | | xss_mode | How the browser should prevent the attack. | block | String | | nosniff | Blocks a request if the requested type is "style" or "script". | true | Bool |

Example:

HTTP::Protection::XSSHeader.new(
  xss_mode: "block"
  nosniff: true
)

Custom logger

It's possible to add a custom logger to replace the default behavior. You can add a logger that outputs to a file, for example.

Example:

log_file = File.open("./protection.log", "w")
HTTP::Protection::Logger.instance = Logger.new(log_file)

Contributors

• rogeriozambon Rogério Zambon - creator, maintainer