randy
bd46b72144
Rack::Session::Cookie re-serializes and re-sets the cookie on every response that even reads session — Rack::Protection's CSRF check does, on nearly every request — reflecting whatever cookie that particular request happened to arrive with, whether or not anything actually changed. A HAR capture caught the real failure mode: seconds after a successful login, offline_data.js's _checkUpdate (an unrelated background poll fired the instant the page loads) was still carrying the browser's pre-login cookie — a client-side timing race across the OAuth redirect chain, not something this server controls — and its own re-issued Set-Cookie landed after the login's, silently overwriting session[:user] with nothing logged anywhere to explain it. Only /login, /auth/callback and /logout ever actually write to session. A before filter now skips the write everywhere else, removing every other response from that race — a stale request can still read a stale cookie, but it can no longer clobber a fresher one. Also drops the earlier except: [:session_hijacking] from the previous commit: rack-protection 4.2.1 only enables SessionHijacking when explicitly opted into via :use, so Sinatra's default setup never turned it on in the first place — the exclusion was a no-op, not the fix.
MapTool
Table of Contents
A mapping application written in Ruby with Sinatra.
The project’s shape is still open — this is the initial scaffold.
Status
Early scaffold. The web application serves a vector map (MapLibre GL JS), with an online style and an optional offline style backed by a local PMTiles file, an animated RainViewer radar overlay, GPX upload/display (points and tracks, organized in folders), and a live position marker from a local GNSS receiver via gpsd.
Requirements
-
Ruby (see
.ruby-version) and Bundler
Getting started
bundle install
bundle exec puma -C config/puma.rbThen open http://127.0.0.1:4567 in a browser.