diff --git a/app/models/user.rb b/app/models/user.rb index 9c5cc7f..23922eb 100755 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -62,7 +62,7 @@ class User < ActiveRecord::Base return auth end -=begin +#=begin # More secure version, still lacking a decent hashing routine, this is for timing attack prevention def self.authenticate(email, password) user = find_by_email(email) || User.new(:password => "") @@ -72,7 +72,7 @@ class User < ActiveRecord::Base raise "Incorrect username or password" end end -=end +#=end def assign_user_id unless @skip_user_id_assign.present? || self.user_id.present? diff --git a/app/views/layouts/shared/_header.html.erb b/app/views/layouts/shared/_header.html.erb index 0be9691..b2ee16d 100755 --- a/app/views/layouts/shared/_header.html.erb +++ b/app/views/layouts/shared/_header.html.erb @@ -26,7 +26,7 @@ going on with funny chars and jquery, plus it says safe so I'm guessing nothing bad will happen --> - Welcome, <%= current_user.first_name.html_safe %> + Welcome, <%= current_user.first_name %>
  • <%= button_to "RailsGoat Tutorials", tutorials_path, {:class => "btn btn-primary", :method => "get"}%> diff --git a/app/views/layouts/tutorial/broken_auth_sess/_httponly_flag.html.erb b/app/views/layouts/tutorial/broken_auth_sess/_httponly_flag.html.erb new file mode 100644 index 0000000..52a13a5 --- /dev/null +++ b/app/views/layouts/tutorial/broken_auth_sess/_httponly_flag.html.erb @@ -0,0 +1,75 @@ +
    +
    +
    + A2 - Broken Authentication and Session Management - Lack of HttpOnly Flag +
    +
    +
    +
    +
    +
    + + + + Description + +
    +
    +
    + INSERT DESC +
    +
    +
    +
    +
    + + + + Bug + +
    +
    +
    +

    + By default, Ruby on Rails protects it's cookies with the HttpOnly flag. However, it is possible to disable this security protection and is not recommended. You can disable this protection using the flag highlighted below. This is an insecure and unnecessary change. +

    + 
    +Railsgoat::Application.config.session_store :cookie_store, key: '_railsgoat_session', httponly: false
+
    +
    +
    +
    +
    +
    + + + + Solution + +
    +
    +
    +

    Lack of Password Complexity - SOLUTION

    + INSERT SOLUTION +
    +
    +
    +
    +
    + + + + Hint + +
    +
    +
    +

    + INSERT DESC +

    +
    +
    +
    +
    +
    +
    diff --git a/app/views/layouts/tutorial/broken_auth_sess/_insecure_compare.html.erb b/app/views/layouts/tutorial/broken_auth_sess/_insecure_compare.html.erb index 98cc566..de35813 100644 --- a/app/views/layouts/tutorial/broken_auth_sess/_insecure_compare.html.erb +++ b/app/views/layouts/tutorial/broken_auth_sess/_insecure_compare.html.erb @@ -67,7 +67,7 @@
    -

    Lack of Password Complexity - SOLUTION

    +

    Insecure Timing Attacks - SOLUTION

    Within app/models/user.rb:

    diff --git a/app/views/tutorials/broken_auth.html.erb b/app/views/tutorials/broken_auth.html.erb index 4953d5b..4b9056c 100755 --- a/app/views/tutorials/broken_auth.html.erb +++ b/app/views/tutorials/broken_auth.html.erb @@ -15,6 +15,11 @@ <%= render :partial => ("layouts/tutorial/broken_auth_sess/insecure_compare")%>
    +
    +
    + <%= render :partial => ("layouts/tutorial/broken_auth_sess/httponly_flag")%> +
    +