Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Real-time page updates for your Rails app over SSE with Mercure, Fanout Cloud or AnyCable and Hotwire Turbo.
broadcast_action_to
and usual helpers.Using this gem requires some knowledge of ActionCable and broadcasting turbo streams. Turbo::Train is designed to mimic those, so it is highly recommended to first try the original to understand the concept.
You can start here and proceed with the Turbo Handbook. One of its chapters will be covering Turbo Streams. Specifically this section would be the main prerequisite to understanding what this gem is about: it covers Broadcastable and the overall idea of working with Mercure or Fanout Cloud.
This should also work for Rails 6, but you will also need to install turbo-rails manually before this gem.
Instructions for Rails 7+
gem 'turbo-train'
bundle install
rails turbo_train:install
Instructions for Rails 6
Mercure is installed as a plugin to Caddy server. For mac users everything is pretty easy:
brew install caddy
caddy add-package github.com/dunglas/mercure/caddy
Now you are ready to run 🚀
caddy run
We only support the cloud version today. To use Fanout you must purchase a paid account with a contract for Fastly's services.
Coming soon.
anycable-go --host=localhost --port=8080 --sse --broadcast_adapter=http --broadcast_key=test --public_streams --noauth
Coming soon.
If you are familiar with broadcasting from ActionCable, usage would be extremely familiar:
<%# app/views/chat_messages/index.html.erb %>
<%= turbo_train_from "chat_messages" %>
<div id="append_new_messages_here"></div>
And then you can send portions of HTML from your Rails backend to deliver live to all currently open browsers:
Turbo::Train.broadcast_action_to(
'chat_messages',
action: :append,
target:'append_new_messages_here',
html: '<span>Test!</span>'
)
or in real world you'd probably have something like
# app/models/chat_message.rb
after_create_commit do
Turbo::Train.broadcast_action_to(
'chat_messages',
action: :append,
target: 'append_new_messages_here',
partial: 'somepath/message'
)
end
You have the same options as original Rails Turbo helpers: rendering partials, pure html, same actions.
To specify different Mercure or Fanout server settings, please adjust the generated config/initializers/turbo_train.rb
file:
Turbo::Train.configure do |config|
config.skip_ssl_verification = true # Development only; don't do this in production
config.default_server = :fanout # Default value is :mercure
config.server :mercure do |mercure|
mercure.mercure_domain = ...
mercure.publisher_key = ...
mercure.subscriber_key = ...
end
config.server :fanout do |fanout|
fanout.service_url = ...
fanout.service_id = ...
fanout.fastly_key = ...
end
config.server :anycable do |fanout|
ac.anycable_url = 'http://0.0.0.0:8080'
ac.broadcast_key = 'test'
end
end
https://#{configuration.mercure_domain}/.well-known
.By default, these are set to localhost
/test
/testing
to match the configuration of the local development server from the installation instructions above.
The gem is available as open source under the terms of the MIT License.
FAQs
Unknown package
We found that turbo-train demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.