Comments on: Rails 2.0, cookie session store and security http://izumi.plan99.net/blog/index.php/2007/11/25/rails-20-cookie-session-store-and-security/ Ecchi nanowa ikenai to omoimasu Tue, 03 Jan 2012 16:14:50 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: 基于CookieStore的session存储机制的安全话题 - IceskYsl@1sters! http://izumi.plan99.net/blog/index.php/2007/11/25/rails-20-cookie-session-store-and-security/comment-page-1/#comment-10147 基于CookieStore的session存储机制的安全话题 - IceskYsl@1sters! Tue, 03 Jan 2012 16:14:50 +0000 http://izumi.plan99.net/blog/index.php/2007/11/25/rails-20-cookie-session-store-and-security/#comment-10147 [...] 最近在看一本《The Rails way》的书，其中关于session存贮机制一章中，对基于CookieStore的session存储机制持否定态度，认为其存在被破解和Replay attack的可能。就我了解的信息来看，这个观点是不妥的。 最详细的一篇文章是写的laigongli写的这篇“Rails 2.0, cookie session store and security”，文章比较长，说的很详细，感兴趣的可以过去看看。其中主要观点为： [...] [...] 最近在看一本《The Rails way》的书，其中关于session存贮机制一章中，对基于CookieStore的session存储机制持否定态度，认为其存在被破解和Replay attack的可能。就我了解的信息来看，这个观点是不妥的。 最详细的一篇文章是写的laigongli写的这篇“Rails 2.0, cookie session store and security”，文章比较长，说的很详细，感兴趣的可以过去看看。其中主要观点为： [...]

]]> By: rtg http://izumi.plan99.net/blog/index.php/2007/11/25/rails-20-cookie-session-store-and-security/comment-page-1/#comment-9299 rtg Thu, 10 Jul 2008 10:01:31 +0000 http://izumi.plan99.net/blog/index.php/2007/11/25/rails-20-cookie-session-store-and-security/#comment-9299 Is it right that the crazy side effect on this is that the default app issues the same cookie id to all anonymous users? I took LovedByLess switched to cookie store and issues exactly the same session id to all users on the same machine... thx rtg Is it right that the crazy side effect on this is that the default app issues the same cookie id to all anonymous users?
I took LovedByLess switched to cookie store and issues exactly the same session id to all users on the same machine…
thx rtg

]]> By: Sligo http://izumi.plan99.net/blog/index.php/2007/11/25/rails-20-cookie-session-store-and-security/comment-page-1/#comment-7515 Sligo Fri, 21 Dec 2007 04:41:27 +0000 http://izumi.plan99.net/blog/index.php/2007/11/25/rails-20-cookie-session-store-and-security/#comment-7515 I am starting to warm up to the idea. I guess the important thing to remember is that you definitely have a choice, and for folks to get bent out of shape over the DEFAULT session mechanism is a bit extreme. We still have lots of options, and if people didn't shake up things once in a while, we would never have progress... I am starting to warm up to the idea. I guess the important thing to remember is that you definitely have a choice, and for folks to get bent out of shape over the DEFAULT session mechanism is a bit extreme. We still have lots of options, and if people didn’t shake up things once in a while, we would never have progress…

]]> By: simplificator » Blog Archive » Rails 2.0 and Session Cookie Store http://izumi.plan99.net/blog/index.php/2007/11/25/rails-20-cookie-session-store-and-security/comment-page-1/#comment-7495 simplificator » Blog Archive » Rails 2.0 and Session Cookie Store Tue, 18 Dec 2007 13:51:01 +0000 http://izumi.plan99.net/blog/index.php/2007/11/25/rails-20-cookie-session-store-and-security/#comment-7495 [...] A long article with some mathematical background (it is insecure because of a flawed random generator) [...] [...] A long article with some mathematical background (it is insecure because of a flawed random generator) [...]

]]> By: Pascal http://izumi.plan99.net/blog/index.php/2007/11/25/rails-20-cookie-session-store-and-security/comment-page-1/#comment-7494 Pascal Tue, 18 Dec 2007 13:30:06 +0000 http://izumi.plan99.net/blog/index.php/2007/11/25/rails-20-cookie-session-store-and-security/#comment-7494 Thanks for the detailed information! "Is session based cookie store a good thing?": as usual in CS the answer is "it depends!" It depends on your applications security requirements. I would not recommend it for an application dealing with private data (i.e. medical records or email) or lots of money (think e-banking). But for applications with less strict security requirements: the benefits might outweigh the risks. But I agree: It just does not feel right :-) Pascal P.s. Don't tell anyone that I have a Post-It with the root password under my keyboard in my unlocked office. Thanks for the detailed information!

“Is session based cookie store a good thing?”: as usual in CS the answer is “it depends!”

It depends on your applications security requirements. I would not recommend it for an application dealing with private data (i.e. medical records or email) or lots of money (think e-banking). But for applications with less strict security requirements: the benefits might outweigh the risks.

But I agree: It just does not feel right :-)

Pascal

P.s. Don’t tell anyone that I have a Post-It with the root password under my keyboard in my unlocked office.

]]> By: Sligo http://izumi.plan99.net/blog/index.php/2007/11/25/rails-20-cookie-session-store-and-security/comment-page-1/#comment-7454 Sligo Sat, 08 Dec 2007 05:25:32 +0000 http://izumi.plan99.net/blog/index.php/2007/11/25/rails-20-cookie-session-store-and-security/#comment-7454 Ok Adam, you win. don't use cookie based session storage with your ajax site. I won't be using it either, and in general I am not a fan of sending cached data back and forth. seems wasteful to me. I assume the id generation will be patched, but even after that, i wont be able to sleep well at night knowing that i am bouncing session data back and forth between my clients and my servers simply because I suddenly have no regard for bandwidth... (Not a fan of viewstate either, but I would choose that in a heartbeat over this) Ok Adam, you win. don’t use cookie based session storage with your ajax site. I won’t be using it either, and in general I am not a fan of sending cached data back and forth. seems wasteful to me. I assume the id generation will be patched, but even after that, i wont be able to sleep well at night knowing that i am bouncing session data back and forth between my clients and my servers simply because I suddenly have no regard for bandwidth… (Not a fan of viewstate either, but I would choose that in a heartbeat over this)

]]> By: Adam Fields http://izumi.plan99.net/blog/index.php/2007/11/25/rails-20-cookie-session-store-and-security/comment-page-1/#comment-7437 Adam Fields Wed, 28 Nov 2007 19:43:27 +0000 http://izumi.plan99.net/blog/index.php/2007/11/25/rails-20-cookie-session-store-and-security/#comment-7437 Yes, but not compared to the size of the average XMLHttpRequest call, which really depends on being as fast as possible. Yes, but not compared to the size of the average XMLHttpRequest call, which really depends on being as fast as possible.

]]> By: Hongli http://izumi.plan99.net/blog/index.php/2007/11/25/rails-20-cookie-session-store-and-security/comment-page-1/#comment-7436 Hongli Wed, 28 Nov 2007 16:59:54 +0000 http://izumi.plan99.net/blog/index.php/2007/11/25/rails-20-cookie-session-store-and-security/#comment-7436 That is correct. That's why it isn't a good thing to store a lot of data in it (it never was in the first place). Though I think the session data size is neglible compared to the size of the average web page. That is correct. That’s why it isn’t a good thing to store a lot of data in it (it never was in the first place). Though I think the session data size is neglible compared to the size of the average web page.

]]> By: Adam Fields http://izumi.plan99.net/blog/index.php/2007/11/25/rails-20-cookie-session-store-and-security/comment-page-1/#comment-7435 Adam Fields Wed, 28 Nov 2007 16:55:09 +0000 http://izumi.plan99.net/blog/index.php/2007/11/25/rails-20-cookie-session-store-and-security/#comment-7435 It may not seem like a lot of data, but the cookies get sent back to the server with every request, including every XMLHttpRequest. If you're storing a lot of info in the session, your roundtrip times are going to start to "mysteriously" lag. It may not seem like a lot of data, but the cookies get sent back to the server with every request, including every XMLHttpRequest. If you’re storing a lot of info in the session, your roundtrip times are going to start to “mysteriously” lag.

]]> By: a work on process » links for 2007-11-27 http://izumi.plan99.net/blog/index.php/2007/11/25/rails-20-cookie-session-store-and-security/comment-page-1/#comment-7432 a work on process » links for 2007-11-27 Tue, 27 Nov 2007 04:21:20 +0000 http://izumi.plan99.net/blog/index.php/2007/11/25/rails-20-cookie-session-store-and-security/#comment-7432 [...] 赖洪礼的 blog » Rails 2.0, cookie session store and security Looking at the security implications of the new session storage which becomes the default in Rails 2.0 (tags: cookies rubyonrails security sessions) [...] [...] 赖洪礼的 blog » Rails 2.0, cookie session store and security Looking at the security implications of the new session storage which becomes the default in Rails 2.0 (tags: cookies rubyonrails security sessions) [...]

]]>