frikandel 1.0.0 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 5d21550e8f406f5cfadd7246e3a5b511e6719b2d
-  data.tar.gz: c205899f482cc2e2e6fc64f69070c7b5f4cdda59
+  metadata.gz: c72cb658721f8dedcdc8981612407748dcd1c3bb
+  data.tar.gz: ce5f11294df1af510cf1c8d95b948217e81b98a7
 SHA512:
-  metadata.gz: 40977fc969914d45e38951d1bcd37577bb8376f8e8c9e13dbf56d2076194973409de535136ee6af30e3c31b5ab34f52b1350e630cc6723c179b0c131f8288b0b
-  data.tar.gz: 62eb2c7883e57b57c297db621bc5eccf42ab4f653a93ff7e7867fa7bc57d386c7765fd11914cdb5f954085c1aea8842d1a27dc33346598b30ebdd7b79334630c
+  metadata.gz: 69bd74f1fdce25360acd89e299cbe245c85a2689d42852023a2bbd5da6bdad711feffe21364b0a53e0498263aa347ef34be7e106cd22152382b4762e57f7383a
+  data.tar.gz: 89c73e22308498ead5d605ad9dd6382b8ef0b463030f7a2a00a600c4debc1908f11d6f12830237b5507bc42b6d7560b2d22d0051a50c6a6055e1546c813ae419

data/README.md

@@ -1,7 +1,18 @@
 # Frikandel
+[![Gem Version](https://badge.fury.io/rb/frikandel.png)](http://badge.fury.io/rb/frikandel) 
+[![Build Status](https://api.travis-ci.org/taktsoft/frikandel.png)](https://travis-ci.org/taktsoft/frikandel)
 
-This Gem adds a TTL (Time To Live) Date to every cookie that your application sets. When the cookie has expired, the users session gets reset. This should help protect from Session-Fixation-Attacks.
+This gem aims to improve the security of your rails application. It allows you to add a TTL (Time To Live) to the session cookie and allows you to bind the session to an IP address.
 
+When the TTL expires or the IP address changes, the users session gets reset. This should help to make [session-fixation-attacks](http://guides.rubyonrails.org/security.html#session-fixation) harder to execute.
+
+
+## Security considerations
+
+Consider the following attack vector: The web application under attack is a rails application. The application writes the user id in the session after a successful login. The attacker has obtained a valid session cookie from an authenticated user.
+By default the cookie is valid indefinitely. If the application tries to "reset the session" it simply issues a new session cookie to the attackers browser. If the attacker just ignores the new session cookie and continues to use the old session cookie the application has no way of knowing that.
+
+By adding a TTL the attack window gets smaller. An stolen has to be used within a given time slot. A reauthentication is enforced after a given time has passed. By adding IP address binding the attacker has to use the same ip address as the victim the session was stolen from.
 
 ## Requirements
 
@@ -28,11 +39,15 @@ Or install it yourself as:
 
 ## Usage
 
-To activate frikandel's Session-Fixation-Protection for your application, you only need to include a module in your `ApplicationController`:
+You can use session TTL or the combination of TTL and IP address binding. Please be advised that the sole use of IP address binding doesn't protect from session-fixation-attacks.
+
+
+To activate Frikandel's session-fixation-protection for your application, you only need to include the proper module(s) in your `ApplicationController`:
 
 ```ruby
 class ApplicationController < ActionController::Base
   include Frikandel::LimitSessionLifetime
+  include Frikandel::BindSessionToIpAddress
 
   # ...
 end
@@ -47,33 +62,37 @@ Frikandel::Configuration.max_ttl = 2.days
 Frikandel::Configuration.ttl = 4.hours
 ```
 
-The value at `Frikandel::Configuration.max_ttl` is the absolute value in seconds that a cookie is valid. In this example, all cookies will be invalidated after two days in all cases. This timestamp doesn't get refreshed.
+The value at `Frikandel::Configuration.max_ttl` is the absolute value (in seconds) that a cookie is valid. In this example, all cookies will be invalidated after two days in all cases. This timestamp doesn't get refreshed. In a typical application that means the user has to re-login after this time. That's also the maximum time frame a stolen session can be used.
 
 The second value `Frikandel::Configuration.ttl` states how long (in seconds) a session/cookie is valid, when the cookie timestamp gets not refreshed. The timestamp gets refrehed everytime a user visits the site.
 
 The default values are `24.hours` for `max_ttl` and `2.hours` for `ttl`. If you are okay with this settings, you don't need to create an initializer for frikandel.
 
 
-### Customize on_expired_session behavior
+### Customize on_invalid_session behavior
 
 You can also overwrite what should happen when a cookie times out on the controller-level. The default behaviour is to do a `reset_session` and `redirect_to root_path`. For example, if you want to overwrite the default behavior when a user is on the `PublicController`, you want to overwrite the `on_expired_session`-method in your controller:
 
 ```ruby
 class PublicController < ApplicationController
-  def on_expired_session
+  def on_invalid_session
     raise "Your Session Has Expired! Oh No!"
   end
 end
 ```
 
-If you want to revert the original behavior in a sub-class of your `PublicController`, you simply re-alias the method to `original_on_expired_session` like this:
+If you want to revert the original behavior in a sub-class of your `PublicController`, you simply re-alias the method to `original_on_invalid_session` like this:
 
 ```ruby
 class AdminController < PublicController
-  alias on_expired_session original_on_expired_session
+  alias on_invalid_session original_on_invalid_session
 end
 ```
 
+## Changes
+
+2.0.0 Added IP address binding. Renamed callback from 'on_expired_session' to 'on_invalid_session'.
+
 ## Contributing
 1. Fork it
 2. Create your feature branch (git checkout -b my-new-feature)

data/lib/frikandel.rb

@@ -1,32 +1,5 @@
 require "frikandel/version"
 require "frikandel/configuration"
-
-module Frikandel
-  module LimitSessionLifetime
-    extend ActiveSupport::Concern
-
-    included do
-      append_before_filter :validate_session_timestamp
-      append_after_filter :persist_session_timestamp
-    end
-
-  private
-
-    def validate_session_timestamp
-      if session.key?(:ttl) && session.key?(:max_ttl) && (session[:ttl] < Frikandel::Configuration.ttl.ago || session[:max_ttl] < Time.now)
-        on_expired_session
-      end
-    end
-
-    def persist_session_timestamp
-      session[:ttl] = Time.now
-      session[:max_ttl] ||= Frikandel::Configuration.max_ttl.from_now
-    end
-
-    def on_expired_session
-      reset_session
-      redirect_to root_path
-    end
-    alias original_on_expired_session on_expired_session
-  end
-end
+require 'frikandel/session_invalidation'
+require 'frikandel/limit_session_lifetime'
+require 'frikandel/bind_session_to_ip_address'

data/lib/frikandel/bind_session_to_ip_address.rb

@@ -0,0 +1,33 @@
+module Frikandel
+  module BindSessionToIpAddress
+    extend ActiveSupport::Concern
+
+    included do
+      append_before_filter :validate_session_ip_address
+      append_after_filter :persist_session_ip_address
+    end
+
+  private
+
+    def validate_session_ip_address
+      if session.key?(:ip_address) && !ip_address_match_with_current?(session[:ip_address])
+        on_invalid_session
+      elsif !session.key?(:ip_address)
+        reset_session
+      end
+    end
+
+    def persist_session_ip_address
+      session[:ip_address] = current_ip_address
+    end
+
+    def current_ip_address
+      request.remote_ip
+    end
+
+    def ip_address_match_with_current?(ip_address)
+      current_ip_address == ip_address
+    end
+
+  end
+end

data/lib/frikandel/limit_session_lifetime.rb

@@ -0,0 +1,26 @@
+module Frikandel
+  module LimitSessionLifetime
+    extend ActiveSupport::Concern
+    include SessionInvalidation
+
+    included do
+      append_before_filter :validate_session_timestamp
+      append_after_filter :persist_session_timestamp
+    end
+
+  private
+
+    def validate_session_timestamp
+      if session.key?(:ttl) && session.key?(:max_ttl) && (session[:ttl] < Frikandel::Configuration.ttl.ago || session[:max_ttl] < Time.now)
+        on_invalid_session
+      elsif !session.key?(:ttl) && !session.key?(:max_ttl)
+        reset_session
+      end
+    end
+
+    def persist_session_timestamp
+      session[:ttl] = Time.now
+      session[:max_ttl] ||= Frikandel::Configuration.max_ttl.from_now
+    end
+  end
+end

data/lib/frikandel/session_invalidation.rb

@@ -0,0 +1,12 @@
+module Frikandel
+  module SessionInvalidation
+
+    private
+
+    def on_invalid_session
+      reset_session
+      redirect_to root_path
+    end
+    alias original_on_invalid_session on_invalid_session
+  end
+end

data/lib/frikandel/version.rb

@@ -1,3 +1,3 @@
 module Frikandel
-  VERSION = "1.0.0"
+  VERSION = "2.0.0"
 end

data/spec/controllers/bind_session_to_ip_address_controller_spec.rb

@@ -0,0 +1,41 @@
+require "spec_helper"
+require "support/application_controller"
+
+class BindSessionToIpAddressController < ApplicationController
+  include Frikandel::BindSessionToIpAddress
+
+  def home
+    render text: "bind test"
+  end
+end
+
+describe BindSessionToIpAddressController do
+  it "writes current ip address to session" do
+    expect(session[:ip_address]).to be_nil
+    get :home
+    expect(session[:ip_address]).to eql("0.0.0.0")
+  end
+
+  it "raises an exception if session address and current ip address don't match" do
+    session[:ip_address] = "1.2.3.4"
+    controller.should_receive(:on_invalid_session)
+
+    get :home
+  end
+
+
+  context "ip address isn't present in session" do
+    it "resets the session" do
+      session[:user_id] = 4337
+      get :home
+
+      session[:user_id].should be_blank
+    end
+
+    it "allows the request to be rendered as normal" do
+      get :home
+
+      response.body.should eql("bind test")
+    end
+  end
+end

data/spec/controllers/combined_controller_spec.rb

@@ -0,0 +1,56 @@
+require "spec_helper"
+require "support/application_controller"
+
+class CombinedController < ApplicationController
+  include Frikandel::LimitSessionLifetime
+  include Frikandel::BindSessionToIpAddress
+
+  def home
+    render text: "combined test"
+  end
+end
+
+describe CombinedController do
+  context "ttl nor ip isn't present in session" do
+    it "resets the session" do
+      session[:user_id] = 4337
+      get :home
+
+      session[:user_id].should be_blank
+      session[:ttl].should be_present
+      session[:ip_address].should be_present
+    end
+
+    it "allows the request to be rendered as normal" do
+      get :home
+
+      response.body.should eql("combined test")
+    end
+  end
+
+  context "ttl or ip isn't present in session" do
+    it "resets the session if ip address is missing" do
+      session[:user_id] = 4337
+      session[:ttl] = "Something"
+      get :home
+
+      session[:user_id].should be_blank
+
+      session[:ttl].should be_present
+      session[:ttl].should_not eql("Something")
+      session[:ip_address].should be_present
+    end
+
+    it "resets the session if ttl is missing" do
+      session[:user_id] = 4337
+      session[:ip_address] = "Something"
+      get :home
+
+      session[:user_id].should be_blank
+
+      session[:ttl].should be_present
+      session[:ip_address].should be_present
+      session[:ip_address].should eql("0.0.0.0")
+    end
+  end
+end

data/spec/controllers/customized_on_invalid_session_controller_spec.rb

@@ -0,0 +1,41 @@
+require "spec_helper"
+require "support/application_controller"
+
+class SessionInvalidError < StandardError; end
+
+class CustomizedOnInvalidSessionController < ApplicationController
+  include Frikandel::LimitSessionLifetime
+
+  def on_invalid_session
+    raise SessionInvalidError.new("Your Session is DEAD!")
+  end
+  alias my_on_invalid_session on_invalid_session
+end
+
+describe CustomizedOnInvalidSessionController do
+
+  it "uses the overwritten on_invalid_cookie function" do
+    get :home
+    request.session[:max_ttl] = 1.minute.ago
+
+    expect { get :home }.to raise_error SessionInvalidError
+  end
+
+  it "can revert the on_invalid_cookie function back to the original" do
+    # NOTE: Don't confuse original_on_invalid_session with my_on_invalid_session!
+    class CustomizedOnInvalidSessionController < ApplicationController
+      alias on_invalid_session original_on_invalid_session # Setting it to the Gems original
+    end
+
+    get :home
+    request.session[:max_ttl] = 1.minute.ago
+
+    begin
+      expect { get :home }.to_not raise_error
+    ensure
+      class CustomizedOnInvalidSessionController < ApplicationController
+        alias on_invalid_session my_on_invalid_session # Reverting it back to the Customized function thats defined in this test
+      end
+    end
+  end
+end

data/spec/controllers/{application_controller_spec.rb → limit_session_lifetime_controller_spec.rb}

@@ -1,8 +1,15 @@
 require "spec_helper"
 require "support/application_controller"
 
-describe ApplicationController do
+class LimitSessionLifetimeController < ApplicationController
+  include Frikandel::LimitSessionLifetime
 
+  def home
+    render text: "ttl test"
+  end
+end
+
+describe LimitSessionLifetimeController do
   it "holds the session for at least .1 seconds" do
     get :home
     session[:user_id] = 1337
@@ -31,16 +38,6 @@ describe ApplicationController do
 
     session[:user_id].should be_blank
   end
-
-  it "works when there was no session in the request" do
-    get :home
-    session[:user_id] = 4337
-    request.session = nil
-    get :home
-
-    session[:user_id].should be_blank
-  end
-
   it "is configurable" do
     old_value = Frikandel::Configuration.ttl
     Frikandel::Configuration.ttl = 1.minute
@@ -54,4 +51,18 @@ describe ApplicationController do
     Frikandel::Configuration.ttl = old_value
   end
 
+  context "ttl isn't present in session" do
+    it "resets the session" do
+      session[:user_id] = 4337
+      get :home
+
+      session[:user_id].should be_blank
+    end
+
+    it "allows the request to be rendered as normal" do
+      get :home
+
+      response.body.should eql("ttl test")
+    end
+  end
 end

data/spec/support/application_controller.rb

@@ -1,13 +1,13 @@
 
 Rails.application.routes.draw do
-  get "/home" => "application#home", as: :root
-  get "/customized_controller_home" => "customized_on_expired_session#home", as: :customized_controller_home
+  root to: "application#home"
+  get "/limit_session_lifetime_home" => "limit_session_lifetime#home"
+  get "/customized_controller_home" => "customized_on_invalid_session#home", as: :customized_controller_home
+  get "/bind_session_to_ip_address_home" => "bind_session_to_ip_address#home"
+  get "/combined_controller_home" => "combined#home"
 end
 
-
 class ApplicationController < ActionController::Base
-  include Frikandel::LimitSessionLifetime
-
   protect_from_forgery with: :exception
 
   def home

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: frikandel
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 2.0.0
 platform: ruby
 authors:
 - Taktsoft
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-04-07 00:00:00.000000000 Z
+date: 2014-04-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -131,10 +131,15 @@ files:
 - Rakefile
 - frikandel.gemspec
 - lib/frikandel.rb
+- lib/frikandel/bind_session_to_ip_address.rb
 - lib/frikandel/configuration.rb
+- lib/frikandel/limit_session_lifetime.rb
+- lib/frikandel/session_invalidation.rb
 - lib/frikandel/version.rb
-- spec/controllers/application_controller_spec.rb
-- spec/controllers/customized_on_expired_cookie_controller_spec.rb
+- spec/controllers/bind_session_to_ip_address_controller_spec.rb
+- spec/controllers/combined_controller_spec.rb
+- spec/controllers/customized_on_invalid_session_controller_spec.rb
+- spec/controllers/limit_session_lifetime_controller_spec.rb
 - spec/dummy/README.rdoc
 - spec/dummy/Rakefile
 - spec/dummy/app/assets/images/.keep
@@ -197,46 +202,48 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.2.1
+rubygems_version: 2.2.2
 signing_key: 
 specification_version: 4
 summary: This gem adds a ttl to the session cookie of your application.
 test_files:
-- spec/dummy/app/controllers/application_controller.rb
-- spec/dummy/app/helpers/application_helper.rb
-- spec/dummy/app/views/layouts/application.html.erb
-- spec/dummy/app/assets/stylesheets/application.css
-- spec/dummy/app/assets/javascripts/application.js
-- spec/dummy/public/404.html
+- spec/lib/frikandel/configuration_spec.rb
+- spec/spec_helper.rb
+- spec/controllers/bind_session_to_ip_address_controller_spec.rb
+- spec/controllers/combined_controller_spec.rb
+- spec/controllers/limit_session_lifetime_controller_spec.rb
+- spec/controllers/customized_on_invalid_session_controller_spec.rb
+- spec/support/application_controller.rb
+- spec/dummy/README.rdoc
+- spec/dummy/db/test.sqlite3
 - spec/dummy/public/500.html
-- spec/dummy/public/422.html
 - spec/dummy/public/favicon.ico
+- spec/dummy/public/422.html
+- spec/dummy/public/404.html
 - spec/dummy/config.ru
-- spec/dummy/README.rdoc
-- spec/dummy/db/test.sqlite3
 - spec/dummy/log/test.log
-- spec/dummy/config/routes.rb
-- spec/dummy/config/application.rb
-- spec/dummy/config/database.yml
-- spec/dummy/config/environments/development.rb
-- spec/dummy/config/environments/test.rb
-- spec/dummy/config/environments/production.rb
-- spec/dummy/config/environment.rb
-- spec/dummy/config/locales/en.yml
-- spec/dummy/config/initializers/backtrace_silencers.rb
+- spec/dummy/config/boot.rb
 - spec/dummy/config/initializers/wrap_parameters.rb
 - spec/dummy/config/initializers/filter_parameter_logging.rb
+- spec/dummy/config/initializers/session_store.rb
+- spec/dummy/config/initializers/secret_token.rb
 - spec/dummy/config/initializers/mime_types.rb
+- spec/dummy/config/initializers/backtrace_silencers.rb
 - spec/dummy/config/initializers/inflections.rb
-- spec/dummy/config/initializers/secret_token.rb
-- spec/dummy/config/initializers/session_store.rb
-- spec/dummy/config/boot.rb
-- spec/dummy/Rakefile
-- spec/dummy/bin/rake
+- spec/dummy/config/locales/en.yml
+- spec/dummy/config/routes.rb
+- spec/dummy/config/environment.rb
+- spec/dummy/config/environments/production.rb
+- spec/dummy/config/environments/test.rb
+- spec/dummy/config/environments/development.rb
+- spec/dummy/config/database.yml
+- spec/dummy/config/application.rb
 - spec/dummy/bin/rails
 - spec/dummy/bin/bundle
-- spec/lib/frikandel/configuration_spec.rb
-- spec/controllers/application_controller_spec.rb
-- spec/controllers/customized_on_expired_cookie_controller_spec.rb
-- spec/spec_helper.rb
-- spec/support/application_controller.rb
+- spec/dummy/bin/rake
+- spec/dummy/app/assets/javascripts/application.js
+- spec/dummy/app/assets/stylesheets/application.css
+- spec/dummy/app/views/layouts/application.html.erb
+- spec/dummy/app/controllers/application_controller.rb
+- spec/dummy/app/helpers/application_helper.rb
+- spec/dummy/Rakefile

data/spec/controllers/customized_on_expired_cookie_controller_spec.rb

@@ -1,39 +0,0 @@
-require "spec_helper"
-require "support/application_controller"
-
-class SessionExpiredError < StandardError; end
-
-class CustomizedOnExpiredSessionController < ApplicationController
-  def on_expired_session
-    raise SessionExpiredError.new("Your Session is DEAD!")
-  end
-  alias my_on_expired_session on_expired_session
-end
-
-describe CustomizedOnExpiredSessionController do
-
-  it "uses the overwritten on_expired_cookie function" do
-    get :home
-    request.session[:max_ttl] = 1.minute.ago
-
-    expect { get :home }.to raise_error SessionExpiredError
-  end
-
-  it "can revert the on_expired_cookie function back to the original" do
-    # NOTE: Don't confuse original_on_expired_session with my_on_expired_session!
-    class CustomizedOnExpiredSessionController < ApplicationController
-      alias on_expired_session original_on_expired_session # Setting it to the Gems original
-    end
-
-    get :home
-    request.session[:max_ttl] = 1.minute.ago
-
-    begin
-      expect { get :home }.to_not raise_error
-    ensure
-      class CustomizedOnExpiredSessionController < ApplicationController
-        alias on_expired_session my_on_expired_session # Reverting it back to the Customized function thats defined in this test
-      end
-    end
-  end
-end