Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion config/initializers/secure_headers.rb
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
SecureHeaders::Configuration.default do |config| # rubocop:disable Metrics/BlockLength
config.hsts = "max-age=#{365.days.to_i}; includeSubDomains; preload"
config.x_frame_options = 'DENY'
config.x_frame_options = Rails.env.development? ? 'ALLOWALL' : 'DENY'
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there any way to make these route specific? If it's anything like the CSP headers, I worry the development-specific allowances risk giving us a false sense that things are working correctly. That being said, I doubt we'll have much use for frames outside these previews 🤷

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There's an allow-from option, so I can try that

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh wait allow-from is obsolete: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

would you prefer ALLOWALL or SAMEORIGIN? I feel like they're roughly the same level of risk since in local development everything is from the same origin, so we can't quite list the specific pages?

config.x_content_type_options = 'nosniff'
config.x_xss_protection = '1; mode=block'
config.x_download_options = 'noopen'
Expand Down
136 changes: 136 additions & 0 deletions spec/mailers/previews/user_mailer_preview.rb
Original file line number Diff line number Diff line change
@@ -0,0 +1,136 @@
class UserMailerPreview < ActionMailer::Preview
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pardon my ignorance of the feature: Is it limited to specific environments out-of-the-box?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, it's limited to development by default, but I'm not finding any direct documentation, only indirect documentation (ex stackoverflow for enabling it in prod which implies it's not enabled in prod, and this tutorial)

def email_confirmation_instructions
UserMailer.email_confirmation_instructions(
User.first,
'foo@bar.gov',
SecureRandom.hex,
request_id: SecureRandom.uuid,
instructions: I18n.t(
'user_mailer.email_confirmation_instructions.first_sentence.forgot_password',
app_name: APP_NAME,
),
)
end

def unconfirmed_email_instructions
UserMailer.unconfirmed_email_instructions(
User.first,
'foo@bar.gov',
SecureRandom.hex,
request_id: SecureRandom.uuid,
instructions: I18n.t(
'user_mailer.email_confirmation_instructions.first_sentence.forgot_password',
app_name: APP_NAME,
),
)
end

def signup_with_your_email
UserMailer.signup_with_your_email(User.first, 'foo@bar.gov')
end

def reset_password_instructions
UserMailer.reset_password_instructions(User.first, 'foo@bar.gov', token: SecureRandom.hex)
end

def password_changed
UserMailer.password_changed(User.first, EmailAddress.first, disavowal_token: SecureRandom.hex)
end

def phone_added
UserMailer.phone_added(User.first, EmailAddress.first, disavowal_token: SecureRandom.hex)
end

def account_does_not_exist
UserMailer.account_does_not_exist('foo@bar.gov', SecureRandom.uuid)
end

def personal_key_sign_in
UserMailer.personal_key_sign_in(User.first, 'foo@bar.gov', disavowal_token: SecureRandom.hex)
end

def new_device_sign_in
UserMailer.new_device_sign_in(
user: User.first,
email_address: EmailAddress.first,
date: 'February 25, 2019 15:02',
location: 'Washington, DC',
disavowal_token: SecureRandom.hex,
)
end

def personal_key_regenerated
UserMailer.personal_key_regenerated(User.first, 'foo@bar.gov')
end

def account_reset_request
UserMailer.account_reset_request(
User.first, EmailAddress.first, User.first.build_account_reset_request
)
end

def account_reset_granted
UserMailer.account_reset_granted(
User.first, EmailAddress.first, User.first.build_account_reset_request
)
end

def account_reset_complete
UserMailer.account_reset_complete(User.first, EmailAddress.first)
end

def account_reset_cancel
UserMailer.account_reset_cancel(User.first, EmailAddress.first)
end

def please_reset_password
UserMailer.please_reset_password(User.first, 'foo@bar.gov')
end

def doc_auth_desktop_link_to_sp
UserMailer.doc_auth_desktop_link_to_sp(User.first, 'foo@bar.gov', 'Example App', '/')
end

def letter_reminder
UserMailer.letter_reminder(User.first, 'foo@bar.gov')
end

def add_email
UserMailer.add_email(User.first, 'foo@bar.gov', SecureRandom.hex)
end

def email_added
UserMailer.email_added(User.first, 'foo@bar.gov')
end

def email_deleted
UserMailer.email_deleted(User.first, 'foo@bar.gov')
end

def add_email_associated_with_another_account
UserMailer.add_email_associated_with_another_account('foo@bar.gov')
end

def sps_over_quota_limit
UserMailer.sps_over_quota_limit('foo@bar.gov')
end

def deleted_user_accounts_report
UserMailer.deleted_user_accounts_report(
email: 'foo@bar.gov',
name: 'my name',
issuers: %w[issuer1 issuer2],
data: 'data',
)
end

def account_verified
UserMailer.account_verified(
User.first,
EmailAddress.first,
date_time: DateTime.now,
sp_name: 'Example App',
disavowal_token: SecureRandom.hex,
)
end
end
20 changes: 20 additions & 0 deletions spec/mailers/previews/user_mailer_preview_spec.rb
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
require 'rails_helper'
require_relative './user_mailer_preview'

RSpec.describe UserMailerPreview do
UserMailerPreview.instance_methods(false).each do |mailer_method|
describe "##{mailer_method}" do
before { create(:user) }

it 'generates a preview without blowing up' do
expect { UserMailerPreview.new.public_send(mailer_method) }.to_not raise_error
end
end
end

it 'has a preview method for each mailer method' do
mailer_methods = UserMailer.instance_methods(false)
preview_methods = UserMailerPreview.instance_methods(false)
expect(mailer_methods - preview_methods).to be_empty
end
end
4 changes: 2 additions & 2 deletions spec/mailers/user_mailer_spec.rb
Original file line number Diff line number Diff line change
Expand Up @@ -112,8 +112,8 @@
end

describe '#new_device_sign_in' do
date = 'Washington, DC'
location = 'February 25, 2019 15:02'
date = 'February 25, 2019 15:02'
location = 'Washington, DC'
disavowal_token = 'asdf1234'
let(:mail) do
UserMailer.new_device_sign_in(
Expand Down