Rails Sessionã«CookieStore使ã£ãŸæ™‚ã®å•é¡Œç‚¹ - OAuth.jp今日 @mad_p ã•ã‚“ã‹ã‚‰RTæ¥ã¦ãŸã“ã®ãƒ„イートã«é–¢ã—ã¦ã€ã¡ã‚‡ã£ã¨èª¿ã¹ãŸã®ã§ã¾ã¨ã‚ã¨ãã¾ã™ã€‚ Security Issue in Ruby on Rails Could Expose Cookies http://t.co/JlsXVEn4rZ — Ruby on Rails News (@RubyonRailsNews) September 25, 2013 å‰ææ¡ä»¶ Railsã§ã¯ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§sessionã‚’cookieã«ã®ã¿ä¿å˜ã—ã¦ã€DBãªã‚Šmemcacheãªã‚Šã®server-side storageã«ã¯ä½•ã‚‚ä¿å˜ã—ã¾ã›ã‚“。 ã“ã‚ŒãŒCookieStoreã¨ã‹å‘¼ã°ã‚Œã¦ã‚‹ã‚„ã¤ã§ã™ã€‚ ã“ã®å ´åˆã®session cookieã¯ã€Railsã®session object (Hash object) ã‚’Marshal.dumpã—ã¦ãã‚Œã«ç½²åを付ã‘ãŸtokenã§ã™ã€‚ rails 4ã§ã¯ç½²å付ã‘る代
{{#tags}}- {{label}}
{{/tags}}