Rack middleware for declaratively setting the HTTP ContentSecurityPolicy (W3C CSP Level 2/3) security header to help prevent against XSS and other browser based attacks.

Rack Middleware for setting content type when not provided

Ensure a nonce is not used twice, to prevent replay attacks.

Implement secure API request igning.

The middleware makes sure any request to specified paths would have been preflighted if it was sent by a browser. We don't want random websites to be able to execute actual GraphQL operations from a user's browser unless our CORS policy supports it. It's not good enough just to ensure that the browser can't read the response from the operation; we also want to prevent CSRF, where the attacker can cause side effects with an operation or can measure the timing of a read operation. Our goal is to ensure that we don't run the context function or execute the GraphQL operation until the browser has evaluated the CORS policy, which means we want all operations to be pre-flighted. We can do that by only processing operations that have at least one header set that appears to be manually set by the JS code rather than by the browser automatically. POST requests generally have a content-type `application/json`, which is sufficient to trigger preflighting. So we take extra care with requests that specify no content-type or that specify one of the three non-preflighted content types. For those operations, we require one of a set of specific headers to be set. By ensuring that every operation either has a custom content-type or sets one of these headers, we know we won't execute operations at the request of origins who our CORS policy will block.

Hit counter Rack Middleware using Memcached

CRUD operations for a rack app.

Generate curl commands that approximate rack requests.

Get the Currently running Rack::Request from anywhere inside the request-thread

Rack middleware to change temporary directory of file upload

this collection of plugins helps to add datamapper functionality to Rack. there is a IdentityMaps plugin which wrappes the request and with it all database actions are using that identity map. the transaction related plugin TransactionBoundaries and RestfulTransactions wrappes the request into a transaction. for using datamapper to store session data there is the DatamapperStore.

WebDAV handler for Rack.

Database console for Ruby applications running on Rack with ActiveRecord and following the Rails "config/database.yml" database configuration pattern

Useful for serving tarballs via Rack

Play a selection from Die Fledermaus with every request.

This is particularly useful in case of varnish caches, preventing them from logging you in as a random person.

Very simple Rack middleware to set an env variable based on user agent

Rack Middleware for detecting robots

Disable CSS3 animations and filter out external JavaScript downloads. Helpful for reliable testing with Capybara.

A Ruby clone of the awesome Webdis Redis web API