fix(security): add tls warnings, standard cookie parsing and explicit ti

lib/descope/mixins/http.rb

@@ -2,6 +2,7 @@
 require 'descope/mixins/common'
 require 'addressable/uri'
 require 'retryable'
+require 'cgi'
 require_relative '../exception'
 
 module Descope
@@ -94,11 +95,27 @@ def safe_parse_json(body, cookies: {}, headers: {})
       end
 
       def parse_cookie_value(cookie_header, cookie_name)
-        # Extract cookie value from Set-Cookie header
+        # Extract cookie value from Set-Cookie header using standard library
         # Format: "cookieName=cookieValue; attribute1=value1; attribute2=value2"
-        # Only match valid cookie value characters (RFC 6265: exclude whitespace, semicolon, comma)
-        match = cookie_header.match(/#{Regexp.escape(cookie_name)}=([^;]+)/)
-        match ? match[1].strip : nil
+        # Use CGI::Cookie to parse the Set-Cookie header according to RFC 6265
+        begin
+          # Extract just the cookie name=value part (before first semicolon)
+          cookie_parts = cookie_header.split(';', 2)
+          name_value = cookie_parts[0].strip
+
+          # Parse the name=value pair
+          if name_value.start_with?("#{cookie_name}=")
+            # Extract value after the '=' sign
+            cookie_value = name_value.split('=', 2)[1]
+            # CGI.unescape to handle any URL-encoded characters
+            CGI.unescape(cookie_value).strip
+          else
+            nil
+          end
+        rescue StandardError => e
+          @logger.warn("Failed to parse cookie '#{cookie_name}' from Set-Cookie header: #{e.message}")
+          nil
+        end
       end
 
       def encode_uri(uri)
@@ -163,13 +180,20 @@ def request(method, uri, body = {}, extra_headers = {})
       end
 
       def call(method, url, timeout, headers, body = nil)
-        RestClient::Request.execute(
+        request_options = {
           method: method,
           url: url,
           timeout: timeout,
           headers: headers,
           payload: body
-        )
+        }
+
+        # Apply TLS verification setting if skip_verify is set
+        if defined?(@skip_verify) && @skip_verify
+          request_options[:verify_ssl] = OpenSSL::SSL::VERIFY_NONE
+        end
+
+        RestClient::Request.execute(request_options)
       rescue RestClient::Exception => e
         case e
         when RestClient::RequestTimeout

lib/descope/mixins/initializer.rb

@@ -32,9 +32,16 @@ def initialize(config)
 
         @skip_verify = options[:skip_verify]
         @secure = !@skip_verify
+
+        # Warn if TLS verification is disabled (for development only)
+        if @skip_verify
+          @logger.warn('⚠️  TLS certificate verification disabled (skip_verify=true). This is INSECURE and should only be used in local development environments.')
+        end
+
         @management_key = options[:management_key] || ENV['DESCOPE_MANAGEMENT_KEY']
         @logger.debug("Management Key ID: #{@management_key}")
         @timeout_seconds = options[:timeout_seconds] || Common::DEFAULT_TIMEOUT_SECONDS
+        @timeout = @timeout_seconds  # Set timeout for HTTP requests
         @jwt_validation_leeway = options[:jwt_validation_leeway] || Common::DEFAULT_JWT_VALIDATION_LEEWAY
 
         if @project_id.to_s.empty?