On Mar 25, 12:52 pm, "Andreas Schwarz" <[EMAIL PROTECTED]> wrote: > On 24 Mrz., 18:55, "Sam Bravard" <[EMAIL PROTECTED]> wrote: > > > What is so broken that requires all of this messy overhead and limitations? > > I agree with your view. Storing session data in cookies is a bad idea, > even if correctly implemented with a nonce. But the current > implementation in Rails is just outright dangerous and should be > removed.
Here, here! I did some more work over the weekend and have come up with some other serious problems, which I want to discuss after I've looked into them more. Koz asked me to try to get a professional review done. To do this, I need two things (preferably from core): 1. A short but precise spec on how the cookie sessions work. The people doing the review may never have seen a line of Ruby in their lives. The spec should be specific and technical, just not assume knowledge of Ruby. It should also be brief, if we want anyone to go over it pro bono. 2. A sample app, with src code and full configuration. It can be simple or even trivial, but it should show how the cookie session is designed to be deployed. But it has to follow the type of use that would be recommended - nothing like "in real life, of course, we'd do it in a more secure way". The configuration and the like are just as important as the app src. --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "Ruby on Rails: Core" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/rubyonrails-core?hl=en -~----------~----~----~----~------~----~------~--~---
