3 ms·

That's quite interesting. Don't forget to make sure you have the secure flag set on your cookies, that way you won't send the cookies over non-SSL connections.

by iuguy 16y ago

That's quite interesting. Don't forget to make sure you have the secure flag set on your cookies, that way you won't send the cookies over non-SSL connections. You should also set the HttpOnly flag, which implements some XSS-limiting features, dependent on the browser. While you're looking at securing session management, it's probably worth looking at Cross-Site Request Forgery: http://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF) http://www.owasp.org/index.php/Cross-Site_Request_Forgery_(C... Some frameworks, such as Django have Cross-Site Request Forgery protection built in for free. The OWASP site linked earlier is an invaluable resource for all things web application security, and is definitely worth bookmarking.

tptacek 16y ago
That's what I came here to say. You almost might as well not use SSL at all if you're not going to set the secure flag, because the same vulnerability that makes "FireSheep" work also allows you to intercept requests and coerce cookies out of them. Of course, there's no trivially installable exploit with a pretty UI that plugs into Firefox to do that yet, so it'll be at least another few years before anyone takes that attack seriously.
- WALoeIII 16y ago
  It should be noted that even cookies marked 'Secure' will be sent over HTTP for versions of Rails prior to 2.3.10 and 3.0.2. https://rails.lighthouseapp.com/projects/8994/tickets/5629-secure-cookies-should-only-be-transmitted-over-ssl https://rails.lighthouseapp.com/projects/8994/tickets/5629-s... And it has been further enhanced recently: http://github.com/rails/rails/commit/2d5a12a50bcd83fcc99865de759b82e661b28698 http://github.com/rails/rails/commit/2d5a12a50bcd83fcc99865d...
samd 16y ago
Rails 3 has helpers you can use to prevent CSRF attacks. This is a good article for any Rails developer: http://guides.rubyonrails.org/security.html http://guides.rubyonrails.org/security.html

by iuguy 16y ago

tptacek 16y ago

That's what I came here to say. You almost might as well not use SSL at all if you're not going to set the secure flag, because the same vulnerability that makes "FireSheep" work also allows you to intercept requests and coerce cookies out of them. Of course, there's no trivially installable exploit with a pretty UI that plugs into Firefox to do that yet, so it'll be at least another few years before anyone takes that attack seriously.

WALoeIII 16y ago
It should be noted that even cookies marked 'Secure' will be sent over HTTP for versions of Rails prior to 2.3.10 and 3.0.2. https://rails.lighthouseapp.com/projects/8994/tickets/5629-secure-cookies-should-only-be-transmitted-over-ssl https://rails.lighthouseapp.com/projects/8994/tickets/5629-s... And it has been further enhanced recently: http://github.com/rails/rails/commit/2d5a12a50bcd83fcc99865de759b82e661b28698 http://github.com/rails/rails/commit/2d5a12a50bcd83fcc99865d...

samd 16y ago

Rails 3 has helpers you can use to prevent CSRF attacks. This is a good article for any Rails developer: http://guides.rubyonrails.org/security.html http://guides.rubyonrails.org/security.html