Sun Dec 4 18:48:03 2015 Jeremy Daer jeremydaer@gmail.com

First-party “SameSite” cookies. Browsers omit SameSite cookies from third-party requests, closing the door on many CSRF attacks.

    Pass `same_site: true` (or `:strict`) to enable:
        response.set_cookie 'foo', value: 'bar', same_site: true
    or `same_site: :lax` to use Lax enforcement:
        response.set_cookie 'foo', value: 'bar', same_site: :lax

    Based on version 7 of the Same-site Cookies internet draft:
    https://tools.ietf.org/html/draft-west-first-party-cookies-07

    Thanks to Ben Toews (@mastahyeti) and Bob Long (@bobjflong) for
    updating to drafts 5 and 7.

Tue Nov 3 16:17:26 2015 Aaron Patterson tenderlove@ruby-lang.org

Add Rack::Events middleware for adding event based middleware: middleware that does not care about the response body, but only cares about doing work at particular points in the request / response lifecycle.

Thu Oct 8 14:58:46 2015 Aaron Patterson tenderlove@ruby-lang.org

Add Rack::Request#authority to calculate the authority under which the response is being made (this will be handy for h2 pushes).

Tue Oct 6 13:19:04 2015 Aaron Patterson tenderlove@ruby-lang.org

Add Rack::Response::Helpers#cache_control and cache_control=. Use this for setting cache control headers on your response objects.

Tue Oct 6 13:12:21 2015 Aaron Patterson tenderlove@ruby-lang.org

Add Rack::Response::Helpers#etag and etag=. Use this for setting etag values on the response.

Sun Oct 3 18:25:03 2015 Jeremy Daer jeremydaer@gmail.com

Introduce Rack::Response::Helpers#add_header to add a value to a multi-valued response header. Implemented in terms of other Response#*_header methods, so it's available to any response-like class that includes the Helpers module.

Add Rack::Request#add_header to match.

Fri Sep 4 18:34:53 2015 Aaron Patterson tenderlove@ruby-lang.org

Rack::Session::Abstract::ID IS DEPRECATED. Please switch to Rack::Session::Abstract::Persisted. Rack::Session::Abstract::Persisted uses a request object rather than the env hash.

Fri Sep 4 17:32:12 2015 Aaron Patterson tenderlove@ruby-lang.org

Pull ENV access inside the request object in to a module. This will help with legacy Request objects that are ENV based but don't want to inherit from Rack::Request

Fri Sep 4 16:09:11 2015 Aaron Patterson tenderlove@ruby-lang.org

Move most methods on the Rack::Request to a module Rack::Request::Helpers and use public API to get values from the request object. This enables users to mix Rack::Request::Helpers in to their own objects so they can implement (get|set|fetch|each)_header as they see fit (for example a proxy object).

Fri Sep 4 14:15:32 2015 Aaron Patterson tenderlove@ruby-lang.org

Files and directories with + in the name are served correctly. Rather than unescaping paths like a form, we unescape with a URI parser using Rack::Utils.unescape_path. Fixes #265

Thu Aug 27 15:43:48 2015 Aaron Patterson tenderlove@ruby-lang.org

Tempfiles are automatically closed in the case that there were too many posted.

Thu Aug 27 11:00:03 2015 Aaron Patterson tenderlove@ruby-lang.org

Added methods for manipulating response headers that don't assume they're stored as a Hash. Response-like classes may include the Rack::Response::Helpers module if they define these methods:

 Rack::Response#has_header?
 Rack::Response#get_header
 Rack::Response#set_header
 Rack::Response#delete_header

Mon Aug 24 18:05:23 2015 Aaron Patterson tenderlove@ruby-lang.org

Introduce Util.get_byte_ranges that will parse the value of the HTTP_RANGE string passed to it without depending on the env hash. byte_ranges is deprecated in favor of this method.

Sat Aug 22 17:49:49 2015 Aaron Patterson tenderlove@ruby-lang.org

Change Session internals to use Request objects for looking up session information. This allows us to only allocate one request object when dealing with session objects (rather than doing it every time we need to manipulate cookies, etc).

Fri Aug 21 16:30:51 2015 Aaron Patterson tenderlove@ruby-lang.org

Add Rack::Request#initialize_copy so that the env is duped when the request gets duped.

Thu Aug 20 16:20:58 2015 Aaron Patterson tenderlove@ruby-lang.org

Added methods for manipulating request specific data. This includes data set as CGI parameters, and just any arbitrary data the user wants to associate with a particular request. New methods:

 Rack::Request#has_header?
 Rack::Request#get_header
 Rack::Request#fetch_header
 Rack::Request#each_header
 Rack::Request#set_header
 Rack::Request#delete_header

Thu Jun 18 16:00:05 2015 Aaron Patterson tenderlove@ruby-lang.org

lib/rack/utils.rb: add a method for constructing "delete" cookie
    headers.  This allows us to construct cookie headers without depending
    on the side effects of mutating a hash.

Fri Jun 12 11:37:41 2015 Aaron Patterson tenderlove@ruby-lang.org

Prevent extremely deep parameters from being parsed. CVE-2015-3225

May 6th, 2015, Thirty seventh public release 1.6.1

May 6th, 2015, Thirty seventh public release 1.5.3

December 18th, 2014, Thirty sixth public release 1.6.0

February 7th, 2013, Thirty fifth public release 1.5.2

February 7th, 2013, Thirty fifth public release 1.4.5

February 7th, Thirty fifth public release 1.1.6, 1.2.8, 1.3.10

January 28th, 2013: Thirty fourth public release 1.5.1

January 21st, 2013: Thirty third public release 1.5.0

January 13th, 2013: Thirty second public release 1.4.4, 1.3.9, 1.2.7, 1.1.5

January 7th, 2013: Thirty first public release 1.4.3

January 7th, 2013: Thirtieth public release 1.3.8

January 6th, 2013: Twenty ninth public release 1.4.2

January 6th, 2013: Twenty eighth public release 1.3.7

January 6th, 2013: Twenty seventh public release 1.2.6

January 6th, 2013: Twenty sixth public release 1.1.4

January 22nd, 2012: Twenty fifth public release 1.4.1

December 28th, 2011: Twenty fourth public release 1.4.0

December 28th, 2011: Twenty first public release: 1.1.3.

October 17, 2011: Twentieth public release 1.3.5

October 1, 2011: Nineteenth public release 1.3.4

September 16, 2011: Eighteenth public release 1.2.4

September 16, 2011: Seventeenth public release 1.3.3

July 16, 2011: Sixteenth public release 1.3.2

July 13, 2011: Fifteenth public release 1.3.1

May 22nd, 2011: Fourteenth public release 1.2.3

May 22nd, 2011: Thirteenth public release 1.3.0

March 13th, 2011: Twelfth public release 1.2.2/1.1.2.

June 15th, 2010: Eleventh public release 1.2.1.

June 13th, 2010: Tenth public release 1.2.0.

January 3rd, 2010: Ninth public release 1.1.0.

October 18th, 2009: Eighth public release 1.0.1.

April 25th, 2009: Seventh public release 1.0.0.

January 9th, 2009: Sixth public release 0.9.1.

January 6th, 2009: Fifth public release 0.9.

August 21st, 2008: Fourth public release 0.4.

February 26th, 2008: Third public release 0.3.

May 16th, 2007: Second public release 0.2.

March 3rd, 2007: First public release 0.1.

vim: set filetype=changelog