3 ms·
If I understand this correctly, given that a private key is needed to successfully modify the signed HTTP cookie, for a closed-source project using Ruby, Rails,
by bhauer 14y ago
If I understand this correctly, given that a private key is needed to successfully modify the signed HTTP cookie, for a closed-source project using Ruby, Rails, and Authlogic, this vulnerability might be better characterized as an "unintentional backdoor."
- numbsafari 14y agoYep, but even if you have a closed-source project you should avoid checking in any secret keys or other credentials to your source control system.