rogeriozambon/http-protection

This library protects against typical web attacks. It was inspired in rack-protection Ruby gem.

http-protection

This library protects against typical web attacks. It was inspired in rack-protection Ruby gem.

Installation

Add this to your application's shard.yml:

dependencies:
  http-protection:
    github: rogeriozambon/http-protection

Usage

require "http/server"
require "http-protection"

server = HTTP::Server.new([
  HTTP::Protection::Deflect.new,
  HTTP::Protection::FrameOptions.new,
  HTTP::Protection::IpSpoofing.new,
  HTTP::Protection::Origin.new,
  HTTP::Protection::PathTraversal.new,
  HTTP::Protection::RemoteReferer.new,
  HTTP::Protection::StrictTransport.new,
  HTTP::Protection::XSSHeader.new
])

server.bind_tcp "0.0.0.0", 8080
server.listen

Deflect middleware

It protects against Denial-of-service attacks. You can define a several options for this middleware.

Option	Description	Default value	Type
interval	Duration in seconds until the request counter is reset.	5	Int32
duration	Duration in seconds that a remote address will be blocked.	900	Int32
threshold	Number of requests allowed.	100	Int32
blacklist	Array of remote addresses immediately considered malicious.	[]	Array(String)
whitelist	Array of remote addresses which bypass Deflect.	[]	Array(String)

Example:

HTTP::Protection::Deflect.new(
  interval: 5,
  duration: 5,
  threshold: 10,
  blacklist: ["111.111.111.111"],
  whitelist: ["222.222.222.222"]
)

FrameOptions middleware

It protects against clickjacking, setting header to tell the browser avoid embedding the page in a frame. You can define one option for this middleware.

Option	Description	Default value	Type
option	Defines who should be allowed to embed the page in a frame. Use "DENY" or "SAMEORIGIN".	SAMEORIGIN	String

Example:

HTTP::Protection::FrameOptions.new(option: "SAMEORIGIN")

IpSpoofing middleware

It detects IP spoofing attacks.

Example:

HTTP::Protection::IpSpoofing.new

Origin middleware

It protects against unsafe HTTP requests when value of Origin HTTP request header doesn't match default or whitelisted URIs. You can define the whitelist of URIs.

Option	Description	Default value	Type
whitelist	Array of allowed URIs	[]	Array(String)

Example:

HTTP::Protection::Origin.new(whitelist: ["http://friend.com"])

PathTraversal middleware

It protects against unauthorized access to file system attacks, unescapes '/' and '.' from PATH_INFO.

Example:

HTTP::Protection::PathTraversal.new

RemoteReferer middleware

It doesn't accept unsafe HTTP requests if the Referer header is set to a different host. You can define the HTTP methods that are allowed.

Option	Description	Default value	Type
methods	Defines which HTTP method should be used.	GET, HEAD, OPTIONS, TRACE	Array(String)

Example:

HTTP::Protection::RemoteReferer.new(methods: ["GET"])

StrictTransport middleware

It protects against protocol downgrade attacks and cookie hijacking. You can define some options for this middleware.

Option	Description	Default value	Type
max_age	How long future requests to the domain should go over HTTPS (in seconds).	31536000	Int32
include_subdomains	If all present and future subdomains will be HTTPS.	false	Bool
preload	Allow this domain to be included in browsers HSTS preload list.	false	Bool

Example:

HTTP::Protection::StrictTransport.new(
  max_age: 31536000,
  include_subdomains: false,
  preload: false
)

XSSHeader middleware

It sets X-XSS-Protection header to tell the browser to block attacks. XSS vulnerabilities enable an attacker to control the relationship between a user and a web site or web application that they trust.

You can define some options for this middleware.

Option	Description	Default value	Type
xss_mode	How the browser should prevent the attack.	block	String
nosniff	Blocks a request if the requested type is "style" or "script".	true	Bool

Example:

HTTP::Protection::XSSHeader.new(
  xss_mode: "block"
  nosniff: true
)

Custom logger

It's possible to add a custom logger to replace the default behavior. You can add a logger that outputs to a file, for example.

Example:

log_file = File.open("./protection.log", "w")
HTTP::Protection::Logger.instance = Logger.new(log_file)

Contributors

• rogeriozambon Rogério Zambon - creator, maintainer

http-protection's Issues

SQL Injection Protection

How about adding some SQLi defense ? I can refresh my shard at: https://github.com/bararchy/crystal-libinjection or just bind around the original lib to have this capability

Add a CODE_OF_CONDUCT.md file for contributors

Create CODE_OF_CONDUCT.md file in the root project and list some examples of behavior that contributes to creating a positive environment.

Add a CONTRIBUTING.md file with contribution guidelines

Create CONTRIBUTING.md file in the root project and list some topics that could use for help to contributors.

Test

Test

Broken Package: Time.now deprecated in crystal 0.33.0

In lib/http-protection/src/http-protection/deflect.cr:46:39

 46 | "expires"  => Time.epoch(Time.now.epoch + @interval).epoch_ms,
                                    ^--
Error: undefined method 'now' for Time.class