3 ms·

Note that 5 is true though. Using a secret to sign or encrypt a cookie does normally work, and it's a common practice. Usually the impact of the secret leaking

Note that 5 is true though. Using a secret to sign or encrypt a cookie does normally work, and it's a common practice. Usually the impact of the secret leaking is that you can impersonate anyone, not that you can run arbitrary code, but the practice of using a session secret is common and not a bad practice nor broken inherently. 3 as well I think is unfair. That isn't something facebook implemented or is relying on; it's just the default behavior of django's debug stack. That's entirely on django to do that and lull people into a false sense of security in some cases (though it also probably helps in many cases too, so it might be okay). The real issues are 1 (leaving debug mode on by accident), 2 (not noticing 1), and 4 (which is a django issue I think, not a facebook one).

smsm42 8y ago
> Using a secret to sign or encrypt a cookie does normally work If the secret key is not compromised. So you have to ask yourself - why you send to the user some info that is so sensitive that needs signing? Why not just keep this info to yourself and send an opaque ID instead? Yes, I know there are issues with it too, but at least this issue is not there. > 3 as well I think is unfair. That isn't something facebook implemented I didn't say it's Facebook fault - though ultimately, of course, it is as much as if you run certain software on your servers and do not configure it properly, it's your fault. So there's a fail in having security key in a place that's so easily accessible that debug mode dumps it without even asking. Not necessarily a direct Facebook fail, but a fail.
- nijave 8y ago
  See JWT. You can make stateless apps easier without worrying about a trip to the database to grab session info https://12factor.net/disposability https://12factor.net/disposability If you want disposability with the ID method you need some sort of datastore or cache to contain session info
collinmanderson 8y ago
Yes, and for #4, Django switched to JSON instead of pickle by default 5 years ago.

smsm42 8y ago

> Using a secret to sign or encrypt a cookie does normally work If the secret key is not compromised. So you have to ask yourself - why you send to the user some info that is so sensitive that needs signing? Why not just keep this info to yourself and send an opaque ID instead? Yes, I know there are issues with it too, but at least this issue is not there. > 3 as well I think is unfair. That isn't something facebook implemented I didn't say it's Facebook fault - though ultimately, of course, it is as much as if you run certain software on your servers and do not configure it properly, it's your fault. So there's a fail in having security key in a place that's so easily accessible that debug mode dumps it without even asking. Not necessarily a direct Facebook fail, but a fail.

nijave 8y ago
See JWT. You can make stateless apps easier without worrying about a trip to the database to grab session info https://12factor.net/disposability https://12factor.net/disposability If you want disposability with the ID method you need some sort of datastore or cache to contain session info

collinmanderson 8y ago

Yes, and for #4, Django switched to JSON instead of pickle by default 5 years ago.