Databases
StackOverflow2013
Postsdbo
POHow do I prevent Rails users from accidentally authenticating as the wrong user?
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POHow do I prevent Rails users from accidentally authenticating as the wrong user?
    primarykey
    data
    text
    <p>Specifically, I have written a Rails app in which I'm using the default (in Rails 2.3.5) <code>CookieStore</code> session store and I've spotted an odd problem in development.</p> <p>Myself and a few others had been using the site for a few weeks and we each had a login based on a username and password (each user registered themselves and I stored the (salted and hashed) data in the database). I was storing the user ID in the Rails <code>session</code> object (and, therefore, in the cookie that is passed back and forth between browser and server).</p> <p>One important point here: since this is an intranet site, I set the cookies to stay alive for up to 2 weeks to avoid users having to log in all the time.</p> <p>Today I reset the database, wiping all user records (and all other data, intentionally). A few users started registering themselves again and then one user found that the first time they went to the site since the wipe they were automatically logged-in as a different user!</p> <p>I think I can see why this happened: the user ID passed from that user's browser to the server now matched a different user-record in my database. My initial thought was "oh dear, I wasn't expecting that!" but the more I thought about it the more I realised this was probably expected behaviour.</p> <p>I realise I can change my Rails app to user <code>ActiveRecordStore</code> but before I did that I wanted to make sure I understand what's going on here. Specifically, does the combination of using <code>CookieStore</code> sessions and having the sessions stay alive for some time really create such a gaping security hole? Or am I missing something? Should the <code>session_id</code> be providing a little more security here?</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. This table or related slice is empty.
    1. USBen
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    3. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POHow do I prevent Rails users from accidentally authenticating as the wrong user?
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POHow do I prevent Rails users from accidentally authenticating as the wrong user?
      1. This table or related slice is empty.
      1. VTUpMod
    1. This table or related slice is empty.
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload