aboutsummaryrefslogtreecommitdiffstats
path: root/ci
diff options
context:
space:
mode:
authorJoseph Wong <joseph.wong@sap.com>2011-07-08 10:39:10 -0700
committerJoseph Wong <joseph.wong@sap.com>2011-07-12 11:09:11 -0700
commit66dee26930048a0134f339d20d237a32ced2770d (patch)
tree41d063b4cb608d5261a94cf98921402c1f71e55a /ci
parente4479b2f1bc54edf155408d51dd3236955150ce1 (diff)
downloadrails-66dee26930048a0134f339d20d237a32ced2770d.tar.gz
rails-66dee26930048a0134f339d20d237a32ced2770d.tar.bz2
rails-66dee26930048a0134f339d20d237a32ced2770d.zip
Fixed session ID fixation for ActiveRecord::SessionStore
I have found that Rails will take an invalid session ID specified by the client and materialize a session based on that session ID. This means that it is possible, among other things, for a client to use an arbitrarily weak session ID or for a client to resurrect a previous used session ID. In other words, we cannot guarantee that all session IDs are generated by the server and that they are (statistically) unique through time. The fix is to always generate a new session ID in #get_session if an existing session cannot be found under the incoming session ID. Also added new tests that make sure that an invalid session ID is never materialized into a new session, regardless of whether it comes in via a cookie or a URL parameter (when :cookie_only => false).
Diffstat (limited to 'ci')
0 files changed, 0 insertions, 0 deletions