diff options
| author | Olivier Lacan <hi@olivierlacan.com> | 2016-03-23 11:21:32 +0100 |
|---|---|---|
| committer | Olivier Lacan <hi@olivierlacan.com> | 2016-03-23 11:21:32 +0100 |
| commit | a2df57c991b844a9b963bc452fa517cc53560686 (patch) | |
| tree | 800c5cdafaf3b8eac46c1a5ec51762950e885a59 /guides | |
| parent | c519d1c2ef28f42342ca4446b8211770b4f551cb (diff) | |
| download | rails-a2df57c991b844a9b963bc452fa517cc53560686.tar.gz rails-a2df57c991b844a9b963bc452fa517cc53560686.tar.bz2 rails-a2df57c991b844a9b963bc452fa517cc53560686.zip | |
Remove reference to unmaintained plugin/gem
[restful-authentication](https://rubygems.org/gems/restful-authentication/versions/1.2.1) hasn't been updated since
September 6th, 2012 so it might not be a great idea to recommend that Rails users try it out.
Devise seems like a much more popular and secure solution that automatically resets sessions on sign in and out
so it's a great example in this case.
/cc @tenderlove @josevalim
Diffstat (limited to 'guides')
| -rw-r--r-- | guides/source/security.md | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/guides/source/security.md b/guides/source/security.md index f4a9f64669..4883c1abe7 100644 --- a/guides/source/security.md +++ b/guides/source/security.md @@ -160,7 +160,7 @@ The most effective countermeasure is to _issue a new session identifier_ and dec reset_session ``` -If you use the popular RestfulAuthentication plugin for user management, add reset_session to the SessionsController#create action. Note that this removes any value from the session, _you have to transfer them to the new session_. +If you use the popular [Devise](https://rubygems.org/gems/devise) gem for user management, it will automatically expire sessions on sign in and sign out for you. If you roll your own, remember to expire the session after your sign in action (when the session is created). This will remove values from the session, therefore _you will have to transfer them to the new session_. Another countermeasure is to _save user-specific properties in the session_, verify them every time a request comes in, and deny access, if the information does not match. Such properties could be the remote IP address or the user agent (the web browser name), though the latter is less user-specific. When saving the IP address, you have to bear in mind that there are Internet service providers or large organizations that put their users behind proxies. _These might change over the course of a session_, so these users will not be able to use your application, or only in a limited way. |