Skip to content
This repository has been archived by the owner on Aug 20, 2019. It is now read-only.

Devise auth_token is not linked to IP address #66

Open
cofiem opened this issue Dec 10, 2012 · 0 comments
Open

Devise auth_token is not linked to IP address #66

cofiem opened this issue Dec 10, 2012 · 0 comments
Labels
authentication bug server

Comments

@cofiem
Copy link
Contributor

cofiem commented Dec 10, 2012

The auth token used by Devise should only be valid when it is used by the same IP address and user agent. Currently a request from a different IP with a valid auth token will succeed. This is bad.

This might be able to be fixed using find_for_authentication in Devise::Models::Authenticatable.
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
authentication bug server
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@cofiem