Skip to content

Commit

Permalink
Applied suggestions by @kratob
Browse files Browse the repository at this point in the history
Co-authored-by: Tobias Kraze <tobias.kraze@makandra.de>
  • Loading branch information
thorsteneckel and kratob authored Mar 10, 2021
1 parent 59755d3 commit 90a4cb2
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,7 @@ CVE-2015-9284 mitigation
--------------

Active Record Session Store in version 1.1.3 and below are affected by [CVE-2019-25025](https://github.com/advisories/GHSA-cvw2-xj8r-mjf7). This means an attacker can perform a timing attack against the session IDs stored in the database. This issue was resolved with `activerecord-session_store` version 1.1.4 thanks to [PR 151](https://github.com/rails/activerecord-session_store/pull/151). The fix contains a backwards compatibilty fallback that migrates affected sessions whenever they are used successfully.
However, as long those sessions exist in your database you are still affected by the security issue. Therefore it's strongly recommended to don't rely on the fallback but to migrate the insecurely stored session IDs instead by using an Active Record Migration (see below for an example). Fortunately the PR also added the `secure!` method to the `ActiveRecord::SessionStore::Session` class that allows programatic migration of those session records. Please be aware that you need to copy/adapt this method if you're using a custom class for storing your sessions (as described earlier in the `Configuration` part of this `README`).
However, as long those sessions exist in your database you are still affected by the security issue. Therefore it is strongly recommended not to rely on the fallback but to actively migrate the insecurely stored session IDs by calling the `#secure!` method on all sessions (see below for an example migration). Please be aware that you need to copy/adapt this method if you're using a custom class for storing your sessions (as described earlier in the `Configuration` part of this `README`).
The following example Active Record Migration will work for the default setup of this gem:

```ruby
Expand Down

0 comments on commit 90a4cb2

Please sign in to comment.