fullware.net

Thanks for Ryan Bates for his recent screencast on the Dangers of Session Hijacking. In short, a session can be hijacked if your user has an https session but then browses to the same site using http. An attacker can capture the cookie with a network sniffer and use it to access the user’s secure session.

If you’re using warden, you can use the serialization hooks to implement Ryan’s strategy.

Warden::Manager.serialize_into_session do |resource|
  if request.ssl?
    # Use an extra token under SSL to block session hijacking
    # Based on http://railscasts.com/episodes/356-dangers-of-session-hijacking
    session[:secure_token] = SecureRandom.hex
    cookies.signed[:secure_token] = {secure: true, value: session[:secure_token]}
  end
  [resource.class.name, resource.id]
end

Warden::Manager.serialize_from_session do |identifier|
  result = nil
  begin
    if !request.ssl? || cookies.signed[:secure_token] == session[:secure_token]
      class_name, id = identifier
      id = id.to_i rescue nil
      klass = Kernel.const_get class_name
      result = klass.find(id) if id.is_a? Integer
    end
  rescue ActiveRecord::RecordNotFound => exc
    # Fail silently, stale cookie or user id
  end
  result
end