On Mar 21, 2007, at 2:15 PM, Jeremy Kemper wrote: > > On 3/17/07, Brad Ediger <[EMAIL PROTECTED]> wrote: >> The CookieStore takes great care to provide integrity of session >> data, but >> we seem to have lost confidentiality in the process. The server- >> side storage >> methods had the implicit advantage of keeping the session data >> secret, but I >> don't know if this was intentional or just an unintended consequence. > > My first cut used symmetric encryption. It's a bit slower than HMAC, > but both push thousands of ops/sec on my laptop so it's not really a > concern. > > The typical session stores a handful of utilitarian info: a user_id, a > flash message, and perhaps a return URL. You shouldn't, and needn't, > use the session for confidential data. > > I consider exposing these data (however obfuscated) as statement of > the reasonable bounds of session usage.
Couldn't agree more, from a philosophical standpoint. And I've never had need to put anything more than the above into a session. I was just looking for an easy way to failsafe the API against someone who decides to use session[:credit_card_number]. Apparently there isn't an easy way, and such people get what they deserve. :-) >> Would anyone see a disadvantage to symmetrically encrypting the >> cookie data >> rather than signing it with an HMAC? > > There isn't much technical disadvantage, though it loses HMAC's > in-the-clear philosophical advantage. Well, I was wrong about the technical disadvantage. See my discussion with S. Robert James in this thread. I'd rather have one big well- known weakness that people can code around than a few lurking ones. I'll transplant parts of this discussion into my Rails book to make this more explicit, especially since CookieStore is the default now. Great job, by the way. It's an elegant solution to a nasty little problem. Brad --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "Ruby on Rails: Core" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/rubyonrails-core?hl=en -~----------~----~----~----~------~----~------~--~---
