[Rails] Re: invalidating a session on multiple login

Peter Ertl
Fri, 23 Jun 2006 10:13:20 -0000

> o give a concrete example, let''s say that user Foo has surfed over
to
 > http://myhost/user/preferences and is editing his preferences page.
 > Now he opens another browser tab and logs in as user Bar.

Why should he log in as a different user? do you want foo to edit bar''s
preferences?
then foo should have administrative privileges for bar but not switch
identity...


Martin DeMello schrieb:
> I don''t see why it''s weird GUI-wise - it''s a
standard application with
> all pages gated by a single user login. There aren''t any roles or
> anything involved; it''s just that the data displayed on the page
> depends on who the logged in user is. Logging in authenticates the
> user against the db, returns a User, and fills it into session[:user].
> Per-controller authentication simply checks that session[:user] is not
> nil - that may be the design flaw, but if it is, I can''t see what
else
> I could do with a pure back-end operation.
>
> To give a concrete example, let''s say that user Foo has surfed
over to
> http://myhost/user/preferences and is editing his preferences page.
> Now he opens another browser tab and logs in as user Bar. I obligingly
> reset the session, logging Foo out. Now let''s say he goes back to
the
> first tab and hits save. It''ll post a preferences form to
> /user/saveprefs, but now session[:user] is Bar, and Bar''s
preferences
> will get updated with the form data Foo was filling in. Short of
> passing in a user id as a parameter to every controller action, or (as
> I mentioned in the last post) having a periodic ajax call to check
> that the user who opened the current page matches the session user, I
> don''t see what to do design-wise to defend against this.
>
> martin
>
> On 6/23/06, Peter Ertl <peter.ertl@gmx.net> wrote:
>> I would reconsider the gui design of your application as this kind of
>> login / logout - scenario is weird...
>>
>> if you have different roles in your applications you should use a user
>> <=> roles mapping
>> and extend the session credentials.
>>
>> Martin DeMello schrieb:
>> > Okay, this is even harder than I thought. Consider the following
use
>> > case: user1 logs in. He opens a new tab and tries to log in again.
>> > Either by making him click logout or transparently, I reset the
>> > session, and log him in as user2. The previous tab will still be
>> > changed to user2, since the session reset can''t affect
the client side
>> > - I''m beginning to think the only thing to do is store
the logged in
>> > user in javascript and do a timed ajax call to see if it matches
the
>> > session user and invalidate the page on the client side if not.
Anyone
>> > have a better idea?
>> >
>> > martin
>> > _______________________________________________
>> > Rails mailing list
>> > Rails@lists.rubyonrails.org
>> > http://lists.rubyonrails.org/mailman/listinfo/rails
>>
>> _______________________________________________
>> Rails mailing list
>> Rails@lists.rubyonrails.org
>> http://lists.rubyonrails.org/mailman/listinfo/rails
>>
> _______________________________________________
> Rails mailing list
> Rails@lists.rubyonrails.org
> http://lists.rubyonrails.org/mailman/listinfo/rails