v0.5.0

Author: MXWXZ

CHANGELOG.md

@@ -1,3 +1,14 @@
+# 0.5.0
+## Breaking changes
+1. `set_default_hsts` is removed, now is default.
+
+## New
+1. Add `default` for `LoggerBuilder` and `Middleware`.
+
+## Changes
+1. Minor session change according to `actix-session`.
+2. Fix several unexpected unwrap.
+
 # 0.4.15
 ## New
 1. `Response` allows for multiple `builder`.

README.md

@@ -107,6 +107,8 @@ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
 ### memorydb-default
 Actix Cloud has a default memory database backend used for sessions. You can also use your own backend if you implement `actix_cloud::memorydb::MemoryDB`.
 
+**The default memorydb is only for demo purpose. The performance is not guaranteed.**
+
 ```
 DefaultBackend::new(None)   // No resource limitation, DDoS is possible!
 DefaultBackend::new(Some(100000000))  // Maximum 100000000 entries.

actix-cloud/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "actix-cloud"
-version = "0.4.15"
+version = "0.5.0"
 edition = "2021"
 authors = ["MXWXZ <matrixwxz@gmail.com>"]
 description = "Actix Cloud is an all-in-one web framework based on Actix Web."
@@ -113,7 +113,7 @@ actix-web = ["dep:actix-web"]
 
 [dependencies]
 # utils
-rand = { version = "0.9", optional = true }
+rand = { version = "0.10", optional = true }
 anyhow = { version = "1.0", optional = true }
 hex = { version = "0.4", optional = true }
 
@@ -133,7 +133,7 @@ tracing-subscriber = { version = "0.3", features = [
     "json",
     "parking_lot",
 ], optional = true }
-colored = { version = "3.0", optional = true }
+colored = { version = "3.1", optional = true }
 futures = { version = "0.3", optional = true }
 
 # tokio
@@ -145,7 +145,7 @@ actix-web = { version = "4", features = ["secure-cookies"], optional = true }
 # memorydb
 glob = { version = "0.3", optional = true }
 parking_lot = { version = "0.12", optional = true }
-priority-queue = { version = "2.6", optional = true }
+priority-queue = { version = "2.7", optional = true }
 
 # chrono
 chrono = { version = "0.4", features = ["serde"], optional = true }
@@ -156,10 +156,10 @@ async-trait = { version = "0.1", optional = true }
 # serde
 serde = { version = "1.0", features = ["derive"], optional = true }
 serde_json = { version = "1.0", optional = true }
-serde_with = { version = "3.14", optional = true }
+serde_with = { version = "3.18", optional = true }
 
 # redis
-redis = { version = "0.32", features = [
+redis = { version = "1.1", features = [
     "tokio-rustls-comp",
     "connection-manager",
 ], optional = true }
@@ -169,7 +169,7 @@ actix-utils = { version = "3.0", optional = true }
 
 # build
 walkdir = { version = "2.5", optional = true }
-yaml-rust2 = { version = "0.10", optional = true }
+yaml-rust2 = { version = "0.11", optional = true }
 quote = { version = "1.0", optional = true }
 syn = { version = "2.0", optional = true }
 prettyplease = { version = "0.2", optional = true }
@@ -179,7 +179,7 @@ tracing-actix-web = { version = "0.7", optional = true }
 
 # csrf
 qstring = { version = "0.7", optional = true }
-enum-as-inner = { version = "0.6", optional = true }
+enum-as-inner = { version = "0.7", optional = true }
 
 # response-build 
 thiserror = { version = "2.0", optional = true }

actix-cloud/src/csrf.rs

@@ -82,7 +82,8 @@ where
         let mut ret: Vec<&str> = req
             .headers()
             .get_all(name)
-            .map(|x| x.to_str().unwrap())
+            .map(|x| x.to_str().unwrap_or_default())
+            .filter(|x| !x.is_empty())
             .collect();
         if ret.len() != 1 {
             return None;

actix-cloud/src/logger.rs

@@ -154,9 +154,9 @@ pub struct LoggerGuard {
 
 impl Drop for LoggerGuard {
     fn drop(&mut self) {
-        self.stop_tx.send(()).unwrap();
+        let _ = self.stop_tx.send(());
         if let Some(x) = self.join.take() {
-            x.join().unwrap();
+            let _ = x.join();
         }
     }
 }
@@ -173,6 +173,12 @@ pub struct LoggerBuilder {
     handler: Option<HandlerFn>,
 }
 
+impl Default for LoggerBuilder {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 impl LoggerBuilder {
     /// Return colored string of `level`.
     ///

actix-cloud/src/request.rs

@@ -34,6 +34,12 @@ pub struct Middleware {
     lang: LangFunc,
 }
 
+impl Default for Middleware {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 impl Middleware {
     fn default_real_ip(req: &ServiceRequest) -> SocketAddr {
         req.peer_addr().unwrap()

actix-cloud/src/security.rs

@@ -125,19 +125,12 @@ impl Default for SecurityHeader {
             x_xss_protection: XXSSProtection::EnableBlock,
             cross_origin_opener_policy: CrossOriginOpenerPolicy::SameOrigin,
             content_security_policy: String::from("default-src 'none'; script-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'"),
-            strict_transport_security: None,
+            strict_transport_security: Some(StrictTransportSecurity::Preload(31536000)),
         }
     }
 }
 
 impl SecurityHeader {
-    /// Set default HSTS to 1 year, includeSubDomains and preload.
-    ///
-    /// `max-age=31536000; includeSubDomains; preload`
-    pub fn set_default_hsts(&mut self) {
-        self.strict_transport_security = Some(StrictTransportSecurity::Preload(31536000));
-    }
-
     pub fn build(self) -> middleware::DefaultHeaders {
         let mut ret = middleware::DefaultHeaders::new()
             .add(("X-Content-Type-Options", "nosniff"))

actix-cloud/src/session/config.rs

@@ -214,7 +214,7 @@ impl SessionMiddlewareBuilder {
     /// # Default
     /// By default, the cookie content is encrypted. Encrypted was chosen instead of signed as
     /// default because it reduces the chances of sensitive information being exposed in the session
-    /// key by accident, regardless of SessionStore implementation you chose to use.
+    /// key by accident, regardless of [`SessionStore`] implementation you chose to use.
     ///
     /// For example, if you are using cookie-based storage, you definitely want the cookie content
     /// to be encrypted—the whole session state is embedded in the cookie! If you are using
@@ -236,7 +236,7 @@ impl SessionMiddlewareBuilder {
         self
     }
 
-    /// Finalise the builder and return a [`SessionMiddleware`] instance.
+    /// Finalize the builder and return a [`SessionMiddleware`] instance.
     #[must_use]
     pub fn build(self) -> SessionMiddleware {
         SessionMiddleware::from_parts(self.storage_backend, self.configuration)

actix-cloud/src/session/middleware.rs

@@ -1,4 +1,4 @@
-use std::{borrow::Cow, collections::HashMap, fmt, future::Future, pin::Pin, rc::Rc, sync::Arc};
+use std::{borrow::Cow, fmt, future::Future, pin::Pin, rc::Rc, sync::Arc};
 
 use actix_utils::future::{ready, Ready};
 use actix_web::{
@@ -8,6 +8,7 @@ use actix_web::{
     http::header::{HeaderValue, SET_COOKIE},
     HttpResponse,
 };
+use serde_json::{Map, Value};
 
 use super::{
     config::{
@@ -31,7 +32,8 @@ use crate::{memorydb::MemoryDB, Result};
 /// Use [`SessionMiddleware::new`] to initialize the session framework using the default parameters.
 /// To create a new instance of [`SessionMiddleware`] you need to provide:
 ///
-/// - an instance of the session storage backend you wish to use (i.e. an implementation of SessionStore);
+/// - an instance of the session storage backend you wish to use (i.e. an implementation of
+///   [`SessionStore`]);
 /// - a secret key, to sign or encrypt the content of client-side session cookie.
 ///
 /// # How did we choose defaults?
@@ -53,7 +55,8 @@ impl SessionMiddleware {
     /// parameters.
     ///
     /// To create a new instance of [`SessionMiddleware`] you need to provide:
-    /// - an instance of the session storage backend you wish to use (i.e. an implementation of SessionStore);
+    /// - an instance of the session storage backend you wish to use (i.e. an implementation of
+    ///   [`SessionStore`]);
     /// - a secret key, to sign or encrypt the content of client-side session cookie.
     pub fn new(client: Arc<dyn MemoryDB>, key: Key) -> Self {
         Self::builder(client, key).build()
@@ -62,7 +65,8 @@ impl SessionMiddleware {
     /// A fluent API to configure [`SessionMiddleware`].
     ///
     /// It takes as input the two required inputs to create a new instance of [`SessionMiddleware`]:
-    /// - an instance of the session storage backend you wish to use (i.e. an implementation of SessionStore);
+    /// - an instance of the session storage backend you wish to use (i.e. an implementation of
+    ///   [`SessionStore`]);
     /// - a secret key, to sign or encrypt the content of client-side session cookie.
     pub fn builder(client: Arc<dyn MemoryDB>, key: Key) -> SessionMiddlewareBuilder {
         SessionMiddlewareBuilder::new(client, config::default_configuration(key))
@@ -151,7 +155,7 @@ where
             let mut ttl = configuration.session.state_ttl;
             let mut cookie = Cow::Borrowed(&configuration.cookie);
             if let Some(x) = session_state.get("_ttl") {
-                if let Ok(x) = x.parse() {
+                if let Some(x) = x.as_i64() {
                     ttl = Duration::seconds(x);
                     let mut tmp = cookie.into_owned();
                     tmp.max_age = Some(ttl);
@@ -160,7 +164,7 @@ where
             }
             let id = session_state
                 .get("_id")
-                .map(|x| x.trim_matches('"').to_owned());
+                .map(|x| x.to_string().trim_matches('"').to_owned());
 
             match session_key {
                 None => {
@@ -268,7 +272,7 @@ fn extract_session_key(req: &ServiceRequest, config: &CookieConfiguration) -> Op
 async fn load_session_state(
     session_key: Option<SessionKey>,
     storage_backend: &SessionStore,
-) -> Result<(Option<SessionKey>, HashMap<String, String>), actix_web::Error> {
+) -> Result<(Option<SessionKey>, Map<String, Value>), actix_web::Error> {
     if let Some(session_key) = session_key {
         match storage_backend.load(&session_key).await {
             Ok(state) => {
@@ -281,14 +285,14 @@ async fn load_session_state(
                     // instead of the `update` workflow if the session state is modified during the
                     // lifecycle of the current request.
 
-                    Ok((None, HashMap::new()))
+                    Ok((None, Map::new()))
                 }
             }
 
             Err(err) => Err(e500(err)),
         }
     } else {
-        Ok((None, HashMap::new()))
+        Ok((None, Map::new()))
     }
 }