Default rack-protection reaction `drop_session` harmful?
Open
Nobody has claimed this yet.
bug
- Dominant language
- Ruby
- Stars
- 12.5k
- Forks
- 2.1k
- PR merge metrics
- No merged PRs in 30d
Description
Sinatra has the some protections enabled by default
but the reaction is set to drop_session
which renders many protections useless? If you want them to actually stop the request from reaching your application
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading rack-protection/lib/rack/protection.rb, lib/sinatra/base.rb, and rack-protection/lib/rack/protection/base.rb at the linked lines to trace the default reaction and request flow. Determine whether drop_session makes the default protections ineffective, then document or test the expected behavior and update the relevant default so protected requests are handled as intended.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ruby
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100