encrypted_cookie_store-instructure 1.0.0 → 1.0.1

data/README.markdown

@@ -66,7 +66,8 @@ EncryptedCookieStore vs other session stores
 EncryptedCookieStore inherits all the benefits of CookieStore:
 
  * It works out of the box without the need to setup a seperate data store (e.g. database table, daemon, etc).
- * It does not require any maintenance. Old, stale sessions do not need to be manually cleaned up, as is the case with PStore and ActiveRecordStore.
+ * It does not require any maintenance. Old, stale sessions do not need to be manually cleaned up, as is the
+   case with PStore and ActiveRecordStore.
  * Compared to MemCacheStore, EncryptedCookieStore can "hold" an infinite number of sessions at any time.
  * It can be scaled across multiple servers without any additional setup.
  * It is fast.
@@ -74,5 +75,16 @@ EncryptedCookieStore inherits all the benefits of CookieStore:
 
 There are of course drawbacks as well:
 
- * You can store at most a little less than 4 KB of data in the session because that's the size limit of a cookie. "A little less" because EncryptedCookieStore also stores a small amount of bookkeeping data in the cookie.
- * Although encryption makes it more secure than CookieStore, there's still a chance that a bug in EncryptedCookieStore renders it insecure. We welcome everyone to audit this code. There's also a chance that weaknesses in AES are found in the near future which render it insecure. If you are storing *really* sensitive information in the session, e.g. social security numbers, or plans for world domination, then you should consider using ActiveRecordStore or some other server-side store.
+ * It is prone to session replay attacks. These kind of attacks are explained in the
+   [Ruby on Rails Security Guide](http://guides.rubyonrails.org/security.html#session-storage). Therefore you
+   should never store anything along the lines of `is_admin` in the session. EncryptedCookieStore does
+   improve on CookieStore in reducing the amount of time allowed for a replay attack to the :expire_after value,
+   instead of forever, but is still weaker than a server side session with an accompanying cookie that allows
+   re-establishment of a session, but not replay of the session contents.
+ * You can store at most a little less than 4 KB of data in the session because that's the size limit of a
+   cookie. "A little less" because EncryptedCookieStore also stores a small amount of bookkeeping data in the cookie.
+ * Although encryption makes it more secure than CookieStore, there's still a chance that a bug in
+   EncryptedCookieStore renders it insecure. We welcome everyone to audit this code. There's also a chance that
+   weaknesses in AES are found in the near future which render it insecure. If you are storing *really* sensitive
+   information in the session, e.g. social security numbers, or plans for world domination, then you should
+   consider using ActiveRecordStore or some other server-side store.

data/encrypted_cookie_store-instructure.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name = %q{encrypted_cookie_store-instructure}
-  s.version = "1.0.0"
+  s.version = "1.0.1"
 
   s.authors = ["Cody"]
   s.date = %q{2012-05-11}

data/lib/encrypted_cookie_store.rb

@@ -99,22 +99,22 @@ private
         @data_cipher.iv = iv
         session_data = @data_cipher.update(encrypted_session_data) << @data_cipher.final
         session_data = inflate(session_data) if compressed
-        return [nil, nil] unless digest == OpenSSL::HMAC.digest(OpenSSL::Digest::Digest.new(@digest), secret, session_data + timestamp.to_s)
+        return [nil, nil, nil] unless digest == OpenSSL::HMAC.digest(OpenSSL::Digest::Digest.new(@digest), secret, session_data + timestamp.to_s)
         if @expire_after
-          return [nil, nil] unless timestamp
-          return [nil, timestamp] unless Time.now.utc.to_i - timestamp < @expire_after
+          return [nil, nil, nil] unless timestamp
+          return [nil, nil, timestamp] unless Time.now.utc.to_i - timestamp < @expire_after
         end
         [Marshal.load(session_data), session_data, timestamp]
       else
-        [nil, nil]
+        [nil, nil, nil]
       end
     else
-      [nil, nil]
+      [nil, nil, nil]
     end
   rescue Zlib::DataError
-    [nil, nil]
+    [nil, nil, nil]
   rescue OpenSSLCipherError
-    [nil, nil]
+    [nil, nil, nil]
   end
 
   def all_unpacked_cookie_data(env)

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: encrypted_cookie_store-instructure
 version: !ruby/object:Gem::Version 
-  hash: 23
+  hash: 21
   prerelease: 
   segments: 
   - 1
   - 0
-  - 0
-  version: 1.0.0
+  - 1
+  version: 1.0.1
 platform: ruby
 authors: 
 - Cody
@@ -15,8 +15,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2012-05-11 00:00:00 -06:00
-default_executable: 
+date: 2012-05-11 00:00:00 Z
 dependencies: []
 
 description: A secure version of Rails' built in CookieStore
@@ -32,7 +31,6 @@ files:
 - README.markdown
 - lib/encrypted_cookie_store.rb
 - encrypted_cookie_store-instructure.gemspec
-has_rdoc: true
 homepage: http://github.com/ccutrer/encrypted_cookie_store
 licenses: []
 
@@ -62,9 +60,10 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 
 rubyforge_project: 
-rubygems_version: 1.5.3
+rubygems_version: 1.8.24
 signing_key: 
 specification_version: 3
 summary: EncryptedCookieStore for Ruby on Rails 2.3
 test_files: []
 
+has_rdoc: