3 ms·
You are right. I think they should issue a new session id when you escalate. That way someone can't ride your session. I checked, and it appears they don't r
by jcampbell1 13y ago
You are right. I think they should issue a new session id when you escalate. That way someone can't ride your session.
I checked, and it appears they don't regenerate the session id when escalating.
I am not an expert, but I think this is a case where you want to regenerate the session id.
- mastahyeti 13y agoWe use Rails CookieStore. The cookie does change when you enter sudo mode, so a session would have to be compromised while you are in sudo mode.
- jcampbell1 13y agoAh, you are correct. It changes in the tail position, and I was only looking at the first bit. Sorry about that. It seems impossible to ride a session in this case, as the GP suggests.