1_passenger_header_collision_vuln.rb

require 'rubygems'
require 'sinatra'
require 'sinatra/contrib'

get "/api/billing_details" do
  expires 300, :private
  case request.env["HTTP_X_AUTHORIZATION"]
  when "b4NceWjP4rFsPEgPKRBCp76a"
    json email: "user-a@example.com", credit_card: "6011111111111117"
  when "AbVxJaeS69vhyx3xYK2rnnNn"
    json email: "user-b@example.com", credit_card: "371449635398431"
  when "EkkF8tmDbAVdEKcjmu3PyZUt"
    json email: "user-c@example.com", credit_card: "3566002020360505"
  else
    json error: "bad auth"
  end
end

2_passenger.txt

$ curl -i -H "X-Authorization: b4NceWjP4rFsPEgPKRBCp76a" http://localhost:3009/api/billing_details && \
curl -i -H "X-Authorization: AbVxJaeS69vhyx3xYK2rnnNn" http://localhost:3009/api/billing_details && \
curl -i -H "X-Authorization: EkkF8tmDbAVdEKcjmu3PyZUt" http://localhost:3009/api/billing_details

HTTP/1.1 200 OK
Status: 200 OK
cache-control: private, max-age=300
content-type: application/json;charset=utf-8
x-content-type-options: nosniff
expires: Thu, 08 Jan 2015 00:13:39 GMT
Date: Thu, 08 Jan 2015 00:08:39 +0000
Content-Length: 63
X-Powered-By: Phusion Passenger 5.0.0.beta2

{"email":"user-a@example.com","credit_card":"6011111111111117"}

-------------------------------------------------------------------

HTTP/1.1 200 OK
Status: 200 OK
cache-control: private, max-age=300
content-type: application/json;charset=utf-8
x-content-type-options: nosniff
expires: Thu, 08 Jan 2015 00:13:39 GMT
Date: Thu, 08 Jan 2015 00:08:39 +0000
Content-Length: 62
X-Powered-By: Phusion Passenger 5.0.0.beta2

{"email":"user-b@example.com","credit_card":"371449635398431"}

-------------------------------------------------------------------

HTTP/1.1 200 OK
Status: 200 OK
cache-control: private, max-age=300
content-type: application/json;charset=utf-8
x-content-type-options: nosniff
expires: Thu, 08 Jan 2015 00:13:39 GMT
Date: Thu, 08 Jan 2015 00:08:39 +0000
Content-Length: 63
Age: 0
X-Powered-By: Phusion Passenger 5.0.0.beta2

{"email":"user-a@example.com","credit_card":"6011111111111117"}

3_thin.txt

$ curl -i -H "X-Authorization: b4NceWjP4rFsPEgPKRBCp76a" http://localhost:3009/api/billing_details && \
curl -i -H "X-Authorization: AbVxJaeS69vhyx3xYK2rnnNn" http://localhost:3009/api/billing_details && \
curl -i -H "X-Authorization: EkkF8tmDbAVdEKcjmu3PyZUt" http://localhost:3009/api/billing_details

HTTP/1.1 200 OK
Content-Type: application/json;charset=utf-8
Cache-Control: private, max-age=300
Expires: Thu, 08 Jan 2015 00:14:18 GMT
Content-Length: 63
X-Content-Type-Options: nosniff
Connection: keep-alive
Server: thin 1.5.1 codename Straight Razor

{"email":"user-a@example.com","credit_card":"6011111111111117"}

-------------------------------------------------------------------

HTTP/1.1 200 OK
Content-Type: application/json;charset=utf-8
Cache-Control: private, max-age=300
Expires: Thu, 08 Jan 2015 00:14:18 GMT
Content-Length: 62
X-Content-Type-Options: nosniff
Connection: keep-alive
Server: thin 1.5.1 codename Straight Razor

{"email":"user-b@example.com","credit_card":"371449635398431"}

-------------------------------------------------------------------

HTTP/1.1 200 OK
Content-Type: application/json;charset=utf-8
Cache-Control: private, max-age=300
Expires: Thu, 08 Jan 2015 00:14:18 GMT
Content-Length: 63
X-Content-Type-Options: nosniff
Connection: keep-alive
Server: thin 1.5.1 codename Straight Razor

{"email":"user-c@example.com","credit_card":"3566002020360505"}