github/overleaf
1
0
Fork 0
mirror of https://github.com/overleaf/overleaf.git synced 2024-11-21 20:47:08 -05:00
Code Issues Projects Releases Packages Wiki Activity

destroy users session before creating a new one for them after login

Browse source 
session changed to prevent against fixation attacks
This commit is contained in:
Henry Oswald 2015-07-01 12:08:57 +01:00
parent 4f0b922a5d
commit 7fd29b18a8
2 changed files with 5 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
services/web/app/coffee/Features/Authentication/AuthenticationController.coffee
View file

@ -154,6 +154,7 @@ module.exports = AuthenticationController =
# Regenerate the session to get a new sessionID (cookie value) to
# protect against session fixation attacks
oldSession = req.session
req.session.destroy()
req.sessionStore.generate(req)
for key, value of oldSession
req.session[key] = value

4
services/web/test/UnitTests/coffee/Authentication/AuthenticationControllerTests.coffee
View file

@ -423,6 +423,7 @@ describe "AuthenticationController", ->
beforeEach ->
@req.session =
save: sinon.stub().callsArg(0)
destroy : sinon.stub()
@req.sessionStore =
generate: sinon.stub()
@AuthenticationController.establishUserSession @req, @user, @callback
@ -435,6 +436,9 @@ describe "AuthenticationController", ->
@req.session.user.referal_id.should.equal @user.referal_id
@req.session.user.isAdmin.should.equal @user.isAdmin
it "should destroy the session", ->
@req.session.destroy.called.should.equal true
it "should regenerate the session to protect against session fixation", ->
@req.sessionStore.generate.calledWith(@req).should.equal true