From ef2bc20c970528aefca623ab698c6efb47698bc5 Mon Sep 17 00:00:00 2001 From: cktricky Date: Thu, 11 Sep 2014 11:01:56 -0400 Subject: [PATCH] working on the httponly tutorial --- app/models/user.rb | 4 +- app/views/layouts/shared/_header.html.erb | 2 +- .../broken_auth_sess/_httponly_flag.html.erb | 75 +++++++++++++++++++ .../_insecure_compare.html.erb | 2 +- app/views/tutorials/broken_auth.html.erb | 5 ++ 5 files changed, 84 insertions(+), 4 deletions(-) create mode 100644 app/views/layouts/tutorial/broken_auth_sess/_httponly_flag.html.erb diff --git a/app/models/user.rb b/app/models/user.rb index 9c5cc7f..23922eb 100755 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -62,7 +62,7 @@ class User < ActiveRecord::Base return auth end -=begin +#=begin # More secure version, still lacking a decent hashing routine, this is for timing attack prevention def self.authenticate(email, password) user = find_by_email(email) || User.new(:password => "") @@ -72,7 +72,7 @@ class User < ActiveRecord::Base raise "Incorrect username or password" end end -=end +#=end def assign_user_id unless @skip_user_id_assign.present? || self.user_id.present? diff --git a/app/views/layouts/shared/_header.html.erb b/app/views/layouts/shared/_header.html.erb index 0be9691..b2ee16d 100755 --- a/app/views/layouts/shared/_header.html.erb +++ b/app/views/layouts/shared/_header.html.erb @@ -26,7 +26,7 @@ going on with funny chars and jquery, plus it says safe so I'm guessing nothing bad will happen --> - Welcome, <%= current_user.first_name.html_safe %> + Welcome, <%= current_user.first_name %>
  • <%= button_to "RailsGoat Tutorials", tutorials_path, {:class => "btn btn-primary", :method => "get"}%> diff --git a/app/views/layouts/tutorial/broken_auth_sess/_httponly_flag.html.erb b/app/views/layouts/tutorial/broken_auth_sess/_httponly_flag.html.erb new file mode 100644 index 0000000..52a13a5 --- /dev/null +++ b/app/views/layouts/tutorial/broken_auth_sess/_httponly_flag.html.erb @@ -0,0 +1,75 @@ +
    +
    +
    + A2 - Broken Authentication and Session Management - Lack of HttpOnly Flag +
    +
    +
    +
    +
    +
    + + + + Description + +
    +
    +
    + INSERT DESC +
    +
    +
    +
    +
    + + + + Bug + +
    +
    +
    +

    + By default, Ruby on Rails protects it's cookies with the HttpOnly flag. However, it is possible to disable this security protection and is not recommended. You can disable this protection using the flag highlighted below. This is an insecure and unnecessary change. +

    + 
    +Railsgoat::Application.config.session_store :cookie_store, key: '_railsgoat_session', httponly: false
+
    +
    +
    +
    +
    +
    + + + + Solution + +
    +
    +
    +

    Lack of Password Complexity - SOLUTION

    + INSERT SOLUTION +
    +
    +
    +
    +
    + + + + Hint + +
    +
    +
    +

    + INSERT DESC +

    +
    +
    +
    +
    +
    +
    diff --git a/app/views/layouts/tutorial/broken_auth_sess/_insecure_compare.html.erb b/app/views/layouts/tutorial/broken_auth_sess/_insecure_compare.html.erb index 98cc566..de35813 100644 --- a/app/views/layouts/tutorial/broken_auth_sess/_insecure_compare.html.erb +++ b/app/views/layouts/tutorial/broken_auth_sess/_insecure_compare.html.erb @@ -67,7 +67,7 @@
    -

    Lack of Password Complexity - SOLUTION

    +

    Insecure Timing Attacks - SOLUTION

    Within app/models/user.rb:

    diff --git a/app/views/tutorials/broken_auth.html.erb b/app/views/tutorials/broken_auth.html.erb index 4953d5b..4b9056c 100755 --- a/app/views/tutorials/broken_auth.html.erb +++ b/app/views/tutorials/broken_auth.html.erb @@ -15,6 +15,11 @@ <%= render :partial => ("layouts/tutorial/broken_auth_sess/insecure_compare")%>
    +
    +
    + <%= render :partial => ("layouts/tutorial/broken_auth_sess/httponly_flag")%> +
    +