Re: Replay attacks with cookie session

S. Robert James
2007-03-25T21:12:22Z

On Mar 25, 12:52 pm, "Andreas Schwarz" <goo...@andreas-s.net>
wrote:
> On 24 Mrz., 18:55, "Sam Bravard" <sam.brav...@gmail.com>
wrote:
>
> > What is so broken that requires all of this messy overhead and
limitations?
>
> I agree with your view. Storing session data in cookies is a bad idea,
> even if correctly implemented with a nonce. But the current
> implementation in Rails is just outright dangerous and should be
> removed.

Here, here!

I did some more work over the weekend and have come up with some other
serious problems, which I want to discuss after I''ve looked into them
more.

Koz asked me to try to get a professional review done.  To do this, I
need two things (preferably
from core):

1. A short but precise spec on how the cookie sessions work. The
people doing the review may never have seen a line of Ruby in their
lives.  The spec should be specific and technical, just not assume
knowledge of Ruby.  It should also be brief, if we want anyone to go
over it pro bono.

2. A sample app, with src code and full configuration.  It can be
simple or even trivial, but it should show how the cookie session is
designed to be deployed.  But it has to follow the type of use that
would be recommended - nothing like "in real life, of course, we''d
do
it in a more secure way".  The configuration and the like are just as
important as the app src.