1

I am working on a Rails app that recently went through a security audit, and one of the issues they came up with is that if the user gets the "session_id" from another users cookie, he is able to log in as that user. Is it possible to prevent this? How would I do it with my current setup?

Rails 3.2.12
devise (2.1.2)

My config/initializers/session_store.rb is 

MyApp::Application.config.tap do |config|
  config.session_store :active_record_store, config.session_options
end

Force SSL is enabled on production

config.force_ssl = true

I looked at Rails 4 Encrypted Cookie Replay Attack but since mine is using active record for sessions, not sure I can do the same.

I tried to add :session_limitable from Devise security extension, but it appears to be doing something else altogether.

To quote the security test result

Mitigate session replaying by ensuring that only 1 login is active at a time. -- able to login as another user just by changing the "_session_id" cookie

Community
  • 1
  • 1
Karthik T
  • 31,456
  • 5
  • 68
  • 87
  • The [Ruby on Rails Security Guide][1] explains what the Session id is used for and why it's not trivial to 'just change' it. [1]: http://guides.rubyonrails.org/security.html – nTraum Nov 21 '13 at 10:42
  • AFAIK devise ensure that `session_id` is reset after every succesfully login – Viren Nov 27 '13 at 14:56

0 Answers0