Added secure flag by default if rack env shows protocol/scheme is https

lib/makara/middleware.rb

@@ -30,7 +30,7 @@ def call(env)
       Makara::Context.set_current new_context(env)
 
       status, headers, body = @app.call(env)
-
+      @cookie[:secure] = is_https_request(env) unless @cookie.keys.include?(:secure)
       store_context(status, headers)
 
       [status, headers, body]
@@ -104,5 +104,13 @@ def store_context(status, headers)
       cookie = @cookie.merge(:value => "#{Makara::Context.get_current}--#{status}")
       Rack::Utils.set_cookie_header! headers, IDENTIFIER, cookie
     end
+
+    # determines if a request is HTTPS based on headers and env variabled
+    def is_https_request(env)
+      env['HTTPS'] == 'on' ||
+        env['HTTP_X_FORWARDED_SSL'] == 'on' ||
+        env['HTTP_X_FORWARDED_PROTO'].to_s.split(',').first == 'https' ||
+        env['rack.url_scheme'] == 'https'
+    end
   end
 end

spec/middleware_spec.rb

@@ -11,7 +11,7 @@
 
   let(:env){ {} }
   let(:proxy){ FakeProxy.new(config(1,2)) }
-  let(:middleware){ described_class.new(app, :secure => true) }
+  let(:middleware){ described_class.new(app) }
 
   let(:key){ Makara::Middleware::IDENTIFIER }
 
@@ -56,7 +56,7 @@
 
     status, headers, body = middleware.call(env)
 
-    expect(headers['Set-Cookie']).to eq("#{key}=#{Makara::Context.get_current}--200; path=/; max-age=5; secure; HttpOnly")
+    expect(headers['Set-Cookie']).to eq("#{key}=#{Makara::Context.get_current}--200; path=/; max-age=5; HttpOnly")
   end
 
   it 'should preserve the same context if the previous request was a redirect' do
@@ -77,6 +77,26 @@
     expect(curr2).to eq(Makara::Context.get_current)
   end
 
+  it 'should set the secure flag on the cookie if the request is HTTPS' do
+    env[:query] = 'update users set name = "phil"'
+    env['HTTPS'] = 'on'
+    status, headers, body = middleware.call(env)
+
+    expect(headers['Set-Cookie']).to eq("#{key}=#{Makara::Context.get_current}--200; path=/; max-age=5; secure; HttpOnly")
+  end
+
+  context 'with secure: true cookie_options' do
+    let(:middleware){ described_class.new(app, secure: false) }
+
+    it 'should permit the secure flag to be overridden, even if the request is HTTPS' do
+      env[:query] = 'update users set name = "phil"'
+      env['HTTPS'] = 'on'
+      status, headers, body = middleware.call(env)
+
+      expect(headers['Set-Cookie']).to eq("#{key}=#{Makara::Context.get_current}--200; path=/; max-age=5; HttpOnly")
+    end
+  end
+
   def context_from(response)
     response[2][0].split('-')
   end