ruby-on-railsruby-on-rails-3sessionauthlogicsession-fixation

Rails 3 with Authlogic and calling reset_session


The RoR Security Guide states that you should "issue a new session identifier and declare the old one invalid after a successful login" using the reset_session method to counter session fixation.

I haven't been able to find any guidance on calling reset_session when using Authlogic. Is it simply a case of including the method in the controller method (as below)?

I'm just concerned about causing problems for Authlogic as I can see both user_credentials and user_credentials_id keys and values in the session hash prior to calling reset_session.

class UserSessionsController < ApplicationController

  def create
    @user_session = current_client.user_sessions.new(params[:user_session])
    if @user_session.save
      reset_session
      flash[:success] = I18n.t(:msg_login_success)
      redirect_back_or_default application_root_path
    else
      render :action => :new
    end
  end

Solution

  • For reference this is my current method:

    def create
      @user_session = current_client.user_sessions.new(params[:user_session])
    
      if @user_session.save
        # reset session to counter session fixation
        # whilst retaining values except for those that the application has created specific to the current user
        temp_session = session.merge("current_user" => {}).clone
        reset_session
        session.reverse_merge!(temp_session)
        # set flash msg and redirect
        flash[:success] = I18n.t(:msg_login_success)
        redirect_back_or_default application_root_path
      else
        render :action => :new
      end
    end
    

    With the call to reset_session still performed after a successful login as per the recommendation in http://guides.rubyonrails.org/security.html#session-fixation-countermeasures