Logout is broken by default in Ruby on Rails Web applications
maverickblogging.com
Logout is broken by default in Ruby on Rails Web applications
1–10 of 59 posts
Re: Logout is broken by default in Ruby on Rails Web applications
#2From the Open Source Vulnerability Database : http://osvdb.org/show/osvdb/97726
Versions concerned: RoR 2.x, 3.x, 4.x
Description : Ruby on Rails contains a flaw in its design that may allow attackers to more easily access applications. The issue is due to the CookieStore mechanism storing cookies on the client side, while not maintaining a corresponding entry on the server side. When an application terminates a session, Ruby on Rails has no method to track this and truly invalidate the cookie with the default configuration. This means that cookies persist "for life" and can be used to access an application even after it is thought to be terminated in many cases.
Solution: Currently, there are no known upgrades or patches to correct this vulnerability. It is possible to temporarily mitigate the flaw by implementing the following workaround: switch to a more secure authentication management systems (e.g. ActiveRecordStore).
Re: Logout is broken by default in Ruby on Rails Web applications
#3I sincerely hope that nobody was using the CookieStore in deployment. I think everybody should know by now that cookies are not safe or secure storage for data.
Re: Logout is broken by default in Ruby on Rails Web applications
#4I sincerely hope that nobody was using the CookieStore in deployment. I think everybody should know by now that cookies are not safe or secure storage for data.
It's a pretty widespread practice. I think it's the Rails default.
Re: Logout is broken by default in Ruby on Rails Web applications
#5This is a very common problem in a lot of signed cookie based session stores. Some frameworks get it right, some don't.
The best remediation is to include an expire timestamp within the content of the signed cookie and to check this on the server - you can't rely on the client deleting the cookie (never trust the client).
The guys at GitHub fixed this particular issue in their rails stack, and submitted a pull request 4 months ago:
https://github.com/rails/rails/pull/11168
It started out well, and their proposed solution would have fixed this problem. The thread got bogged down in discussing backwards compatibility and the original submitter just gave up on it.
I hope this might trigger somebody to pick that pull request up again and get it sorted and merged.
Since signed cookies are now a popular form of persisting session state I have been meaning to run through all the popular web app frameworks to check this issue.
edit: check out TimedSerializer from the itsdangerous Python library that Flask uses:
https://github.com/mitsuhiko/itsdangerous/blob/master/itsdan...
Re: Logout is broken by default in Ruby on Rails Web applications
#6I sincerely hope that nobody was using the CookieStore in deployment. I think everybody should know by now that cookies are not safe or secure storage for data.
It's a pretty widespread practice. I think it's the Rails default.
Sure, it's the default, but don't people realize never to trust clientside data? I don't know if CookieStore is signed or not, but I generally assume even if I sign the data it's not safe.
It's not that hard to just set up a Redis or whatever store to handle stuff like this, I never understood why people whouldn't bother.
Re: Logout is broken by default in Ruby on Rails Web applications
#7I'm surprised that this issue is being raised now. It seems like it should have been obvious.
It looks like a fundamental design problem with a client side token... You can limit intrusions by adding an expires_at value to the cookie data. But I don't see any way to actually expire a token without some server side tracking.
Re: Logout is broken by default in Ruby on Rails Web applications
#8This is a very common problem in a lot of signed cookie based session stores. Some frameworks get it right, some don't. The best remediation is to include an expire timestamp within the content of the signed cookie and to check this on the server - you can't rely on the client deleting the cookie ( never trust the client). The guys at GitHub fixed this particular issue in their rails stack, and submitted a pull reque…
Just as an example, Django uses a default SESSION_COOKIE_AGE of 2 weeks [1]
[1] - https://docs.djangoproject.com/en/dev/ref/settings/#std:sett...
Re: Logout is broken by default in Ruby on Rails Web applications
#9Pretty sure this can be fixed with a timestamp in the session data. You can either expire the timestamp by time or by keeping a datetime field on the user and updating the timestamp after a password change. Or you can use a combination of these two.
This is not a new issue. It is a well known limitation of the cookie store. I've been working around this with timestamps for years.
Re: Logout is broken by default in Ruby on Rails Web applications
#10I sincerely hope that nobody was using the CookieStore in deployment. I think everybody should know by now that cookies are not safe or secure storage for data.
Cookie-based sessions have many, very reasonable, use cases.
You are also clearly neglecting the fact that proper session cookies are _always_ cryptographically signed and cannot be tampered with, if properly implemented.