16

I have a web app, lets say http://web.example.com making a POST request to http://api.example.com. The api server is running the latest version of Sinatra with rack protection enabled. I am getting this error 'attack prevented by Rack::Protection::HttpOrigin'.

I can do something like this:

set :protection, :except => [:http_origin]

but I feel like I am just ignoring the actual problem.

I have tried to do this:

use Rack::Protection::HttpOrigin, :origin_whitelist => ['http://web.example.com']

but I still get the warning.

The request does not get rejected, but Sinatra clears my session see this post and I need the session_id.

Any help or examples on how to specify the option_whitelist for the HttpOrigin class would be greatly appreciated.

kelsmj
  • 1,183
  • 11
  • 18
  • Have you tried `use Rack::Protection, :origin_whitelist => ['http://web.example.com']` ? Looking at [the source](https://github.com/rkh/rack-protection/blob/master/lib/rack/protection/http_origin.rb), I think you can dispose of the array too (unless you're adding several paths) as a single string is wrapped in an array anyway. – ian Dec 29 '12 at 19:41
  • That doesn't seem to work either. I got my original example from the libraries spec tests [here](https://github.com/rkh/rack-protection/blob/master/spec/http_origin_spec.rb) – kelsmj Dec 29 '12 at 21:09

1 Answers1

21

Pass your options as a hash to set :protection:

set :protection, :origin_whitelist => ['http://web.example.com']

Sinatra will then pass them through to Rack::Protection when setting it up.

I suspect the reason it is failing when you have use Rack::Protection::HttpOrigin, :origin_whitelist => ['http://web.example.com'] is that you still have protection enabled, so that you end up with two instances of HttpOrigin. You could try

set :protection, :except => [:http_origin]
use Rack::Protection::HttpOrigin, :origin_whitelist => ['http://web.example.com']

(i.e. have both the lines you’ve tried together), but I think the first solution is cleaner.

matt
  • 78,533
  • 8
  • 163
  • 197