diff --git a/app/models/user.rb b/app/models/user.rb index 7e92104..f5030fd 100755 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -25,17 +25,28 @@ class User < ActiveRecord::Base def self.authenticate(email, password) auth = nil user = find_by_email(email) - if user + raise "#{email} doesn't exist!" if !(user) if user.password == Digest::MD5.hexdigest(password) auth = user else raise "Incorrect Password!" end - else - raise "#{email} doesn't exist!" - end return auth end + +=begin + # More secure version, but still lacking a decent hashing routine + def self.authenticate(email, password) + user = find_by_email(email) + if user and Rack::Utils.secure_compare(user.password, Digest::MD5.hexdigest(password)) + return user + else + raise "Incorrect username or password" + end + end +=end + + def assign_user_id unless @skip_user_id_assign.present? || self.user_id.present? diff --git a/app/views/layouts/tutorial/broken_auth_sess/_insecure_compare.html.erb b/app/views/layouts/tutorial/broken_auth_sess/_insecure_compare.html.erb new file mode 100644 index 0000000..776384d --- /dev/null +++ b/app/views/layouts/tutorial/broken_auth_sess/_insecure_compare.html.erb @@ -0,0 +1,69 @@ +
+
+
+ A3 - Broken Authentication and Session Management - Insecure Compare and Timing Attacks +
+
+
+
+
+
+ + + + Description + +
+
+
+ +
+
+
+
+
+ + + + Bug + +
+
+
+ +
+
+
+
+
+ + + + Solution + +
+
+
+ +
+
+
+
+
+ + + + Hint + +
+
+
+

+ +

+
+
+
+
+
+
diff --git a/app/views/tutorials/broken_auth.html.erb b/app/views/tutorials/broken_auth.html.erb index 7d85147..606693c 100755 --- a/app/views/tutorials/broken_auth.html.erb +++ b/app/views/tutorials/broken_auth.html.erb @@ -10,6 +10,11 @@ <%= render :partial => ("layouts/tutorial/broken_auth_sess/password_complexity")%> +
+
+ <%= render :partial => ("layouts/tutorial/broken_auth_sess/insecure_compare")%> +
+