Cookie session security and open-source - Ruby on Rails: Core

Message from discussion Cookie session security and open-source

Assaf Arkin

More options Aug 6 2008, 9:00 pm

From: "Assaf Arkin" <as...@labnotes.org>

Date: Wed, 6 Aug 2008 18:00:47 -0700

Local: Wed, Aug 6 2008 9:00 pm

Subject: Re: [Rails-core] Cookie session security and open-source

  Reply to author
  |
  Forward
  | Print
  | View thread
  | Show original
  | Report this message
  | Find messages by this author
  

On Wed, Aug 6, 2008 at 3:34 PM, Trevor Turk <trevort...@gmail.com> wrote:

> I've noticed that quite a number of open-source Rails apps are using
> the new cookie session feature, and have the session secret predefined
> in the config/environment.rb file. I'm no expert on this, but I was
> under the impression that the "secret key" needed to be kept secret or
> there is a security problem. Maybe everyone who downloads these apps
> is taking the time to change the secret key before deploying them into
> production, but I generally haven't found anything in the installation
> instructions to indicate that end-users should do so. This concerns me
> a bit.

> Clearly, there's an easy solution to this (potential) problem: don't
> use a secret key that you didn't generate yourself. What I'm wondering
> is if this is an area where Rails could be doing more to automate this
> stuff. Perhaps a solution would be to store an automatically generated
> session id and key in the database, much like with schema_migrations?

Yep, that's an exploit waiting to happen.

Another option. I was thinking of putting the secret key in a separate
file and not checking it into source control. Have
config/environment.rb load that file, or create it if necessary. So
if you're just checking out the sources, you get a different key from
everyone else. For deployment, symlink to a share directory, say
somewhere in /etc.

Assaf

> Thanks,
> - Trevor

Reply to author Forward