lib/active_record/session_store/session.rb
# This method was introduced when addressing CVE-2019-16782
# (see https://github.com/rack/rack/security/advisories/GHSA-hrqr-hxpp-chr3).
# Sessions created on version <= 1.1.3 were guessable via a timing attack.
# To secure sessions created on those old versions, this method can be called
# on all existing sessions in the database. Users will not lose their session
# when this is done.
This method was introduced when addressing CVE-2019-16782
.
Sessions created on version <= 1.1.3 were guessable via a timing attack.
To secure sessions created on those old versions, this method can be called
on all existing sessions in the database. Users will not lose their session
when this is done.
This method was introduced when addressing CVE - 2019 - 16782 . Sessions created on version < = 1 . 1 . 3 were guessable via a timing attack . To secure sessions created on those old versions this method can be called on all existing sessions in the database . Users will not lose their session when this is done .
def secure!
        session_id_column = if self.class.columns_hash['sessid']
          :sessid
        else
          :session_id
        end
        raw_session_id = read_attribute(session_id_column)
        if ActionDispatch::Session::ActiveRecordStore.private_session_id?(raw_session_id)
        else
          session_id_object = Rack::Session::SessionId.new(raw_session_id)
          update_column(session_id_column, session_id_object.private_id)
        end
      end
def secure! session_id_column = if self . class . columns_hash [ 'sessid' ] :sessid else :session_id end raw_session_id = read_attribute ( session_id_column ) if ActionDispatch :: Session :: ActiveRecordStore . private_session_id? ( raw_session_id ) else session_id_object = Rack :: Session :: SessionId . new ( raw_session_id ) update_column ( session_id_column , session_id_object . private_id ) end end
This method was introduced when addressing CVE-2019-16782
(see https://github.com/rack/rack/security/advisories/GHSA-hrqr-hxpp-chr3).
This method was introduced when addressing CVE - 2019 - 16782 ( see https : // github . com / rack / rack / security / advisories / GHSA - hrqr - hxpp - chr3 ) .
# is already private, nothing to do