Skip to content

Instantly share code, notes, and snippets.

@dgutov

dgutov/app.rb

Created May 12, 2013 19:59
Show Gist options
  • Save dgutov/5564706 to your computer and use it in GitHub Desktop.
Save dgutov/5564706 to your computer and use it in GitHub Desktop.
Download ZIP
Rack::Protection::SessionHijacking video tag false positive
Raw
app.rb
require "sinatra"
require "pry"
enable :sessions
set :session_secret, "cupcakes"
get "/" do
session[:sheep] ||= 0
session[:sheep] += 1
erb :index
end
get "/video" do
session[:sheep] ||= 0
erb :video
end
Raw
config.ru
require './app'
run Sinatra::Application
Raw
index.erb
<html>
<head>
<title>Test</title>
</head>
<body>
<p>Session: <%= session[:session_id] %></p>
<p>Sheep count: <%= session[:sheep] %></p>
<img src="/foo.png" />
<a href="/video">video</a>
</body>
</html>
Raw
video.erb
<html>
<head>
<title>Test</title>
</head>
<body>
<p>Session: <%= session[:session_id] %></p>
<p>Sheep count: <%= session[:sheep] %></p>
<video src="/foo.mp4" />
<a href="/">back</a>
</body>
</html>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment