rack-protection: Don't track the Accept-Language header by default

[temochka]

The existing default is inappropriate for any applications that accept websocket connections.

Some browsers (e.g., Safari 12, Chrome 71) don't set the Accept-Language header for websocket requests. A mixture of requests with and without this header results in unavailable sessions in websocket handlers. This affects both Sinatra apps and other websocket apps using rack-protection in their middleware stack.

Considering the partial nature ("this will not prevent determined hijacking attempts") of the employed defense mechanism and current proliferation of TLS support on the web, I propose relaxing the defaults (the attached patch) or disabling the middleware altogether (happy to help with that too).

Attaching request dumps for 3 modern browsers retrieved by running socket = new WebSocket("ws://localhost:4669") from the Developer Console against a local netcat server (nc -l 127.0.0.1 4669).

Safari 12:

GET / HTTP/1.1
Upgrade: websocket
Connection: Upgrade
Host: localhost:4669
Origin: http://localhost:4666
Pragma: no-cache
Cache-Control: no-cache
Sec-WebSocket-Key: SeL+g6qVeCy+TSczXF7Wjw==
Sec-WebSocket-Version: 13
Sec-WebSocket-Extensions: x-webkit-deflate-frame
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15
Cookie: [concealed]

Chrome 71:

GET / HTTP/1.1
Upgrade: websocket
Connection: Upgrade
Host: localhost:4669
Origin: http://localhost:4666
Pragma: no-cache
Cache-Control: no-cache
Sec-WebSocket-Key: JfgrzYvGA1oPtZLasrWOMQ==
Sec-WebSocket-Version: 13
Sec-WebSocket-Extensions: x-webkit-deflate-frame
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15
Cookie: [concealed]

Firefox 63:

GET / HTTP/1.1
Host: localhost:4669
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:63.0) Gecko/20100101 Firefox/63.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Sec-WebSocket-Version: 13
Origin: http://localhost:4666
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 06XKqwIb6Vs6idQ7ilvv5w==
Connection: keep-alive, Upgrade
Cookie: [concealed]
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

[temochka]

Update: The CI failure seems unrelated to changes in this branch. All tests pass on my local machine.

[namusyaka]

@temochka Travis CI failure should be fixed in #1505 . Could you rebase and push again?

[namusyaka]

Looks reasonable to me. Thanks!

[temochka]

Thanks, @namusyaka! 🎉