Rails' CookieStore isn't broken • Hacker News Board

Re: Rails' CookieStore isn't broken

#21

Post by FooBarWidget » Mon, Oct 14, 2013, 1:27 PM UTC

etfb wrote: post #19

progn wrote: post #16

Earlier quoted context omitted.

> I always assumed cryptography is slower than IO Cryptography is a CPU-bound operation that often has specialized hardware support. Here's a rule of thumb: in modern computing, IO incurs a greater cost than pretty much anything you can do locally on-CPU. IO is incredibly expensive: cryptography, not so much. If you pipeline your crypto operations and disk fetches, you won't increase response latency at all.

Ruby has a reputation for slowness ([citation needed]?) so is the cryptographic stuff implemented in the language itself or via C-or-equivalent foreign library? I could understand the "too slow, must avoid" kneejerk reaction if it's all in Ruby, even if the reputation is no longer deserved. Human nature.

Cryptography in Ruby uses OpenSSL wrapper, so it's essentially C.

Re: Rails' CookieStore isn't broken

#22

Post by eric970 » Mon, Oct 14, 2013, 1:33 PM UTC

So the provided solution is, essentially, to store a list of active user sessions in the database and use that as a reference during authentication?

Re: Rails' CookieStore isn't broken

#23

Post by eric970 » Mon, Oct 14, 2013, 1:35 PM UTC

gnur wrote: post #4

The CookieStore isn't broken but you do need to add code to fix the issue? I have no experience with Rails but I really hadn't expected that sessions would be client-side only.

Storing IDs in session cookies is not something the Rails framework introduced. Smh. It's easier to blame someone else's code though.

Re: Rails' CookieStore isn't broken

#24

Post by thijsc » Mon, Oct 14, 2013, 1:54 PM UTC

damncabbage wrote: post #20

sneak wrote: post #18

Earlier quoted context omitted.

> Especially when cookies are easily stolen using something like Firesheep Who in late 2013 (with enough clue to care about this issue) is still using non-secure-flag cookies for anything even remotely important?!

As far as I'm Rails doesn't use secure-flag cookies by default; you need to have something like this in config/initializers/session_store.rb: local_env = !(Rails.env.test? || Rails.env.development?) MyApp::Application.config.session_store(:cookie_store, { key: '_my_app_session', secure: local_env, # ... or just true }) Yes, somebody who has gone looking for this can find it, but I'd argue that Rails should at least g…

You can set config.force_ssl = true to easily enable secure session cookies and strict transport security amongst other things.

Re: Rails' CookieStore isn't broken

#25

Post by rmrfrmrf » Mon, Oct 14, 2013, 2:18 PM UTC

thibaut_barrere wrote: post #12

PLejeck wrote: post #7

Earlier quoted context omitted.

I'm suggesting that site operators need to use HTTPS. It doesn't matter if you use Rails, PHP, Node.js, whatever. USE HTTPS. NEVER USE HTTP. It's as simple as that. Never assume that anything transmitted over HTTP is safe, because that assumption will come back to bite you.

Exactly - use force_ssl true in the case of Rails.

do you ever get a headache from sitting in this echo chamber all day?

Re: Rails' CookieStore isn't broken

#26

Post by tptacek » Mon, Oct 14, 2013, 2:31 PM UTC

etfb wrote: post #17

I have to declare Inigo Montoya on the use of the word "trivially" in that article, though I see from a comment here that someone's already issued a patch that I presume will get included in the next version, so perhaps it will become trivial shortly.

Wasn't that Vizzini?

Re: Rails' CookieStore isn't broken

#27

Post by thibaut_barrere » Mon, Oct 14, 2013, 2:36 PM UTC

rmrfrmrf wrote: post #25

thibaut_barrere wrote: post #12

Earlier quoted context omitted.

Exactly - use force_ssl true in the case of Rails.

do you ever get a headache from sitting in this echo chamber all day?

I'm not sure to understand (I see that you're likely using irony, but I'm not a native english speaker).

Are you suggesting not using SSL?

If not, can you clarify your point?

Thanks.

Re: Rails' CookieStore isn't broken

#28

Post by ptomato » Mon, Oct 14, 2013, 3:34 PM UTC

tptacek wrote: post #26

etfb wrote: post #17

I have to declare Inigo Montoya on the use of the word "trivially" in that article, though I see from a comment here that someone's already issued a patch that I presume will get included in the next version, so perhaps it will become trivial shortly.

Wasn't that Vizzini?

It was Vizzini who kept using that word, and Montoya who did not think it meant what he (Vizzini) thought it meant.

Re: Rails' CookieStore isn't broken

#29

Post by jrochkind1 » Mon, Oct 14, 2013, 4:01 PM UTC

If you're going to store info about sessions in the database and thus have to query the database on every request to make sure the cookie-delivered session is okay... why wouldn't you just use the ActiveRecord session store instead of the cookie store?

What do you gain by using the cookie store with this database component, over just using the active record store to begin with? (The ActiveRecord store used to be the default back in... Rails 2.0?)

Re: Rails' CookieStore isn't broken

#30

Post by InAnEmergency » Mon, Oct 14, 2013, 4:30 PM UTC

thibaut_barrere wrote: post #13

gnur wrote: post #4

The CookieStore isn't broken but you do need to add code to fix the issue? I have no experience with Rails but I really hadn't expected that sessions would be client-side only.

FWIW, the fact that the default session store is client-side only is mentioned in the overview for beginners: http://guides.rubyonrails.org/action_controller_overview.htm...

It's also mentioned in the security guide: http://guides.rubyonrails.org/security.html#session-storage