Re: Replay attacks with cookie session

Brad Ediger
2007-03-23T17:29:54Z

OK, here it is: svn://svn.madriska.com/plugins/raisin_cookies

To use, install the plugin and start up the DRb server from the DRb
session store (action_controller/session/drb_server.rb).

The DRb server keeps a hash mapping session HMACs to the latest nonce
used with the session. The nonce is verified along with the HMAC on
unmarshal. That way, old sessions are invalidated because the HMAC of
the session must be presented with the latest nonce stored in the DRb
backend.

Right now, the code issues a new nonce on each update; it should
probably check first to see if the data has been updated, but it
doesn''t right now.

Very simple benchmarking shows a 10-15% impact on reqs/sec with this
plugin. I would guess that most of that comes from the nonce
generation (I use Rails''s CGI::Session.generate_unique_id, which has
to create an MD5 hash for each session). I don''t really have the time
to look further, however. I only tested with a single Mongrel. Does
anyone care to do some performance studies on this?

Brad

On Mar 23, 2007, at 11:52 AM, Brad Ediger wrote:

> Good points. I worked up a quick plugin that uses DRb to store the
> nonce, and I''m doing some benchmarks on it now. I don''t
have time
> for anything fancy, but we can at least get in the ballpark.
>
<snip>
>>
>> Anyone care to try a generic, automatic nonce and benchmark the
>> results?
>>
>> jeremy