Skip to content

Update framework defaults to match those in Rails 5.1#2309

Merged
benhalpern merged 6 commits intoforem:masterfrom
rhymes:rhymes/update-framework-defaults-to-rails51
Apr 17, 2019
Merged

Update framework defaults to match those in Rails 5.1#2309
benhalpern merged 6 commits intoforem:masterfrom
rhymes:rhymes/update-framework-defaults-to-rails51

Conversation

@rhymes
Copy link
Copy Markdown
Contributor

@rhymes rhymes commented Apr 4, 2019

What type of PR is this? (check all applicable)

  • Refactor
  • Feature
  • Bug Fix
  • Documentation Update

Description

Now that the code base has been migrated to Rails 5.2 it should be safe to upgrade framework defaults to match those of the previous version. The new defaults for Rails 5.2, see new_framework_defaults_5_2.rb can be turned on individually later on.

Regarding the flipped flags:

  • per_form_csrf_tokens increases security by adding CSRF tokens in each generated form
  • forgery_protection_origin_check checks that the request comes from the same origin
  • to_time_preserves_timezone is an old flag for Ruby 2.4 and date time conversion
  • belongs_to_required_by_default fails validation if a belongs_to association is not explicitly declared as optional and missing during validation (I checked the code, all the optional associations seem to be correctly declared)
  • form_with_generates_remote_forms makes form_with (unused in the source code) generate remote form by default

I've also re-enabled two CSRF tokens that were disabled, let me know if they should be left alone (I've tested them manually and they worked)

Related Tickets & Documents

Mobile & Desktop Screenshots/Recordings (if there are UI changes)

Added to documentation?

  • docs.dev.to
  • readme
  • no documentation needed

@rhymes rhymes changed the title [WIP] Update framework defaults to match those in Rails 5.1 Update framework defaults to match those in Rails 5.1 Apr 4, 2019
@pr-triage pr-triage bot added the PR: unreviewed bot applied label for PR's with no review label Apr 4, 2019
@benhalpern
Copy link
Copy Markdown
Contributor

I think there may be issues with our current use of Rails that get in the way of how we do stuff.

Currently we can't send CSRF tokens over with typical page requests on articles because we cache a shared version for all users. If we sent the CSRF token it would cache for the first request and then leak to subsequent requests. We load CSRF async to account for this.

I'm not totally clear on the consequences of the proposed changes, but I believe it would compromise this constraint eh?

@rhymes
Copy link
Copy Markdown
Contributor Author

rhymes commented Apr 5, 2019

@benhalpern

I didn't know that :( I've noticed the async load for the CSRF and I was wondering the reason why, thanks for the explanation.

What the per_form_csrf_tokens flag does is to add one more CSRF inside forms (but keeping the global one) to lower the risk of forgery. I don't know the answer to your question yet, I'll investigate further. We can safely revert that anyhow.

I'd keepforgery_protection_origin_check because it checks if the origin of the request matches.

@rhymes
Copy link
Copy Markdown
Contributor Author

rhymes commented Apr 7, 2019

@benhalpern I don't think there's an easy way to have per form CSRF tokens and caching, the same way you had to build this mechanism to get around of caching and tokens in the first place. I reverted the changes related to that and made sure it's explained clearly in the application.rb for future readers

Copy link
Copy Markdown
Contributor

@benhalpern benhalpern left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks good. Thanks. I think sticking with a previous convention is okay for now. We can brainstorm additional layers of security that might be possible down the road.

@benhalpern benhalpern merged commit f17d0f3 into forem:master Apr 17, 2019
@pr-triage pr-triage bot added PR: reviewed-approved bot applied label for PR's where reviewer approves changes PR: merged bot applied label for PR's that are merged and removed PR: unreviewed bot applied label for PR's with no review labels Apr 17, 2019
@rhymes rhymes deleted the rhymes/update-framework-defaults-to-rails51 branch April 17, 2019 16:36
@rhymes
Copy link
Copy Markdown
Contributor Author

rhymes commented Apr 17, 2019

Thanks @benhalpern !

coreyja added a commit to coreyja/dev.to that referenced this pull request Apr 20, 2019
* master: (83 commits)
  Update gitdocs (forem#2500)
  Condense 'ask me anything' to 'ama' (forem#2428) [ci skip]
  Add user_signed_in? to cache key for styles (forem#2498)
  Added troubleshooting for byebug without readline issue (forem#2481)
  Fix some frontend linting issues (forem#2495) [ci skip]
  Fix <br/> in footer. (forem#2491)
  Remove extra param and add message for prefill (forem#2487)
  Make Cards Change Dynamically and add Reader/Follower Charts (forem#2488)
  Temporarily comment out random (forem#2486)
  Add nav buttons to pwa desktop (forem#2484)
  Feature/filtered charts (forem#2482)
  Add caching for historical data (forem#2476)
  There are installation sections for other OSes now. (forem#2480)
  Add inbox guidelines to users (forem#2473)
  Release Open Inbox (forem#2468)
  Convert underscores in article slugs properly (forem#2472)
  Update framework defaults to match those in Rails 5.1 (forem#2309)
  Enable random order for specs (forem#2466) [ci skip]
  forem#118 Allow users to embed Medium posts with Liquid Tags (forem#1161)
  Allow API to return top articles (forem#2469)
  ...

# Conflicts:
#	Envfile
#	app/models/user.rb
#	db/schema.rb
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

PR: merged bot applied label for PR's that are merged PR: reviewed-approved bot applied label for PR's where reviewer approves changes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants