Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP

Loading…

removal of unique_session_id on explicit user logout #59

Open
wants to merge 3 commits into from

3 participants

@klobuczek

This change cleans up the unique_session_id from the db when the user logs out. This was necessary as our security department objected that if the user logs out, but the response for some reason doesn't reach the client, or the response is maliciously intercepted, or the browser (or modification of it) doesn't properly invalidate the cookie, or the cookie has been copied before logout, the system can still be accessed using the cookie.

I had to add the conditional to preserve the current behavior of the gem.

@mrcsparker

Is there any update on when this will get added? I really need this also.

@rahim

+1

I recently had to implement similar myself for the same reasons - it feels like this should be the default behaviour of session limitable - if you're explicitly blocking concurrent sessions then an old session should be invalidated as soon as we know this. Sometimes this may still only be at next login, but where we know this earlier (through explicit logout) we can minimise the window that a leaked session cookie would be useful to an attacker.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Commits on Aug 19, 2013
  1. @klobuczek
Commits on Aug 20, 2013
  1. @klobuczek

    fixed bug in pull #56

    klobuczek authored
Commits on Aug 22, 2013
  1. @klobuczek

    added a check before updating unique_session_id since if the user tri…

    klobuczek authored
    …es to logout after session timeout the record will be nil
This page is out of date. Refresh to see the latest.
View
2  VERSION
@@ -1 +1 @@
-0.7.2
+0.7.4
View
2  devise_security_extension.gemspec
@@ -5,7 +5,7 @@
Gem::Specification.new do |s|
s.name = "devise_security_extension"
- s.version = "0.7.3"
+ s.version = "0.7.4"
s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
s.authors = ["Marco Scholl", "Alexander Dreher"]
View
8 lib/devise_security_extension/hooks/session_limitable.rb
@@ -19,8 +19,16 @@
if warden.authenticated?(scope) && options[:store] != false
if record.unique_session_id != warden.session(scope)['unique_session_id'] && !env['devise.skip_session_limitable']
+ def record.skip_before_logout?; end
warden.logout(scope)
throw :warden, :scope => scope, :message => :session_limited
end
end
+end
+
+#Remove unique_session_id on explicit logout
+Warden::Manager.before_logout do |record, warden, options|
+ if record.respond_to?(:update_unique_session_id!) && !record.respond_to?(:skip_before_logout?)
+ record.update_unique_session_id!(nil)
+ end
end
View
2  lib/devise_security_extension/models/password_archivable.rb
@@ -62,7 +62,7 @@ def old_password_params
salt_change = if self.respond_to?(:password_salt_change) and not self.password_salt_change.nil?
self.password_salt_change.first
end
- { :encrypted_password => self.encrypted_password_change.first, :password_salt => salt_change }.permit!
+ { :encrypted_password => self.encrypted_password_change.first, :password_salt => salt_change }
end
module ClassMethods
Something went wrong with that request. Please try again.