[Rails] Re: invalidating a session on multiple login

Martin DeMello
Fri, 23 Jun 2006 11:26:42 -0000

On 6/23/06, Peter Ertl <peter.ertl@gmx.net> wrote:
>  > o give a concrete example, let''s say that user Foo has
surfed over to
>  > http://myhost/user/preferences and is editing his preferences page.
>  > Now he opens another browser tab and logs in as user Bar.
>
> Why should he log in as a different user? do you want foo to edit
bar''s
> preferences?
> then foo should have administrative privileges for bar but not switch
> identity...

He might have two accounts on the system. Or he might have walked away
from the machine and his roommate might have logged in. Actually, I
picked the wrong example to demonstrate the problem - say, instead,
that a user has_many documents, which are listed on the screen, with
checkboxes next to them. Bar can now check a bunch of boxes and hit
delete; the app, trusting that, if Foo had the privileges to view the
documents, he has the privileges to delete them, goes ahead and does
so. To defend against that I''d need to put in a check for every action
on a document that document.user matches session.user (actually, now
that I mention it, I should probably do that anyway, in a spirit of
healthy paranoia, but what else have I missed?)

Gmail does the right thing here - if I log in with a different user in
the same browser, my earlier session automatically goes invalid on the
client side.

martin