Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Logout is broken by default in Ruby on Rails Web applications

maverickblogging.com

Post reply on HN
Print view View original

31–40 of 59 posts

Re: Logout is broken by default in Ruby on Rails Web applications

#31

Post by sjwright »

nikcub wrote: post #5

This is a very common problem in a lot of signed cookie based session stores. Some frameworks get it right, some don't. The best remediation is to include an expire timestamp within the content of the signed cookie and to check this on the server - you can't rely on the client deleting the cookie ( never trust the client). The guys at GitHub fixed this particular issue in their rails stack, and submitted a pull reque…

The solution I use in my own application is for each cookie that gets set to be a distinct, random shared secret that is mirrored in a database table.

The shared secret is the combination of a near-random string of bytes generated by a hash of numerous things, plus a unique ID generated upon insert into the database table. The secret survives in the table until the user chooses to sign out, or until the cookie expires. Once the secret is expired, the cookie is useless.

This also means users can go into their account page to see on which devices their account has been remembered, but also to log out any/all other sessions.

Re: Logout is broken by default in Ruby on Rails Web applications

#32

Post by PLejeck »

yuvadam wrote: post #10
PLejeck wrote: post #3

I sincerely hope that nobody was using the CookieStore in deployment. I think everybody should know by now that cookies are not safe or secure storage for data.

Cookie-based sessions have many, very reasonable, use cases. You are also clearly neglecting the fact that proper session cookies are _always_ cryptographically signed and cannot be tampered with, if properly implemented.

They do, and they are signed, but they still have issues like this which are so easily mitigated by just using a goddamn server.

Re: Logout is broken by default in Ruby on Rails Web applications

#34

Post by Xylakant »

PLejeck wrote: post #32
yuvadam wrote: post #10

Earlier quoted context omitted.

Cookie-based sessions have many, very reasonable, use cases. You are also clearly neglecting the fact that proper session cookies are _always_ cryptographically signed and cannot be tampered with, if properly implemented.

They do, and they are signed, but they still have issues like this which are so easily mitigated by just using a goddamn server.

Using a server based session storage is simple as long as your whole app lives in one datacenter and all frontend hosts can reach said server. Once you have app servers in multiple datacenters (e.g. for geo loadbalancing) and want to provide a seamless login no matter which server the user ends up on server based session storage just gets a lot harder. (Apart from having to handle a massive write load which used to cause major pain with mysql, myisam and database based session storage, but these times are luckily over).

Re: Logout is broken by default in Ruby on Rails Web applications

#35

Post by PLejeck »

Xylakant wrote: post #34
PLejeck wrote: post #32

Earlier quoted context omitted.

They do, and they are signed, but they still have issues like this which are so easily mitigated by just using a goddamn server.

Using a server based session storage is simple as long as your whole app lives in one datacenter and all frontend hosts can reach said server. Once you have app servers in multiple datacenters (e.g. for geo loadbalancing) and want to provide a seamless login no matter which server the user ends up on server based session storage just gets a lot harder. (Apart from having to handle a massive write load which used to c…

Redis is an ideal data store for this kind of thing, will be doubly so once we have Redis Cluster.

But still, if your frontend hosts can't reach your database, you have far bigger problems than your sessions not working.

Re: Logout is broken by default in Ruby on Rails Web applications

#36

Post by epochwolf »

thibaut_barrere wrote: post #21
epochwolf wrote: post #9

Pretty sure this can be fixed with a timestamp in the session data. You can either expire the timestamp by time or by keeping a datetime field on the user and updating the timestamp after a password change. Or you can use a combination of these two. This is not a new issue. It is a well known limitation of the cookie store. I've been working around this with timestamps for years.

Can you share maybe the code you're using to do that? As well: rotating the secret token every night could probably be used to discard all existing cookies, right? (although this is a bit brute force and will kick out anyone currently using the app).

Nope. The last version I wrote is buried in a rails app at a company I no longer work for.

It's a three or four line before filter in the application controller. I reimplement it every time since it's relatively simple.

I don't have it on any public code since it's also the last thing I implement before launching.

Re: Logout is broken by default in Ruby on Rails Web applications

#37

Post by liveoneggs »

PLejeck wrote: post #35
Xylakant wrote: post #34

Earlier quoted context omitted.

Using a server based session storage is simple as long as your whole app lives in one datacenter and all frontend hosts can reach said server. Once you have app servers in multiple datacenters (e.g. for geo loadbalancing) and want to provide a seamless login no matter which server the user ends up on server based session storage just gets a lot harder. (Apart from having to handle a massive write load which used to c…

Redis is an ideal data store for this kind of thing, will be doubly so once we have Redis Cluster. But still, if your frontend hosts can't reach your database, you have far bigger problems than your sessions not working.

redis is single master so all non-local web servers will be extra slow. It is a poor solution for multi datacenter.

Re: Logout is broken by default in Ruby on Rails Web applications

#38

Post by luikore »

Misleading. It's not a problem of CookieStore or Rails, it's the problem of HTTP. Changing session store to a database or memory store won't fix it: a session id is still required on the client side, then your session is still hijacked because the attacker still gets the session id. You may want to make the session id change after each request, then you are re-inventing TCP and ruining user experience. If the attacker can steal CookieStore, that means the attacker can also see everything else in the page, just securing the session does little help -- please stop worrying and use HTTPS (and add "secure" option for the cookie entry).

CookieStore does its own job correctly: it has an "httponly" option which prevents being stolen by injected javascript, and it checks signature which prevents content being modified or forged. But it's not CookieStore's job to prevent sensitive content being watched. It's HTTPS's job.

Re: Logout is broken by default in Ruby on Rails Web applications

#39

Post by rimantas »

willvarfar wrote: post #17
epochwolf wrote: post #11

Earlier quoted context omitted.

Cookie store has always been signed and in rails 4 it's encrypted.

Very sloppy it wasn't encrypted from day 1 imo.

Day 1 was eight years ago. Care to tell which popular web frameworks did that then?

Re: Logout is broken by default in Ruby on Rails Web applications

#40

Post by marcamillion »

patio11 wrote: post #25

This feels less like a framework bug for me than an app bug -- an impressively common app bug, I'll grant you, but an app bug nonetheless. Rails doesn't ship with user management. It's pretty upfront about that, and the docs tell you to roll your own since it is easy, and the community will tell you to use Devise since that will save you time since you'll be doing repetitive work for substantially all apps otherwise.…

So using Devise gets around this issue right?
Post reply on HN