Fix for session ID fixation issue in ActiveRecord::SessionStore (squashed commits) #2039

merged 1 commit into from Jul 12, 2011
Commits on Jul 12, 2011
  1. @jhtwong

    Fixed session ID fixation for ActiveRecord::SessionStore

    jhtwong committed Jul 8, 2011
    I have found that Rails will take an invalid session ID specified by the
    client and materialize a session based on that session ID. This means
    that it is possible, among other things, for a client to use an
    arbitrarily weak session ID or for a client to resurrect a previous used
    session ID. In other words, we cannot guarantee that all session IDs are
    generated by the server and that they are (statistically) unique through
    The fix is to always generate a new session ID in #get_session if an
    existing session cannot be found under the incoming session ID.
    Also added new tests that make sure that an invalid session ID is never
    materialized into a new session, regardless of whether it comes in via a
    cookie or a URL parameter (when :cookie_only => false).