# Sessions and authorization

**URL:** <https://www.ruby-forum.com/t/sessions-and-authorization/191172>\
**Category:** Rails\
**Created:** [July 6, 2010, 11:52pm UTC](https://www.ruby-forum.com/t/sessions-and-authorization/191172 "2010-07-06T23:52:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ralphshnelvar](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e19adc/32.png) [@ralphshnelvar](https://www.ruby-forum.com/u/ralphshnelvar)\
**Post date:** [July 6, 2010, 11:52pm UTC](https://www.ruby-forum.com/t/sessions-and-authorization/191172/1 "2010-07-06T23:52:39Z")

</div>

I’m looking at page 162 in _Agile Web D. with Rails_ and in  
there they do the following once they find that a user has logged in  
with the right name and password:

* * *

def login  
if request.post?  
user = User.authenticate(params[:username], params[:password])  
if user  
session[:user\_id] = user.id  
redirect\_to(:action =\> “index”)  
else  
flash.now[:notice] = “Invalid user/password combination”  
end  
end  
end

* * *

The line that concerns me is  
session[:user\_id] = user.id

The authors write  
#########  
The logni action will need to record something in session to say that an  
administrator is logged in. Let’s have it store the id of their User  
object using the hey user.id. The login code looks like this:  
#########

Given that the session data is likely to be stored in cookies, and given  
that user.id is likely to be a relatively small number (less than a  
million) … how secure is this as a flag to indicate that someone is an  
authorized user of a store??? Couldn’t an unauthorized user create the  
session[:user\_id] = user.id and then get access?

---

<div class="post-metadata">

**Author:** ![ralphshnelvar](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e19adc/32.png) [@ralphshnelvar](https://www.ruby-forum.com/u/ralphshnelvar)\
**Post date:** [July 7, 2010, 12:07am UTC](https://www.ruby-forum.com/t/sessions-and-authorization/191172/2 "2010-07-07T00:07:06Z")

</div>

Ralph S. wrote:

> The line that concerns me is  
> session[:user\_id] = user.id  
> …  
> Given that the session data is likely to be stored in cookies, and given  
> that user.id is likely to be a relatively small number (less than a  
> million) … how secure is this as a flag to indicate that someone is an  
> authorized user of a store??? Couldn’t an unauthorized user create the  
> session[:user\_id] = user.id and then get access?

A good question! You are thinking the right way. Fortunately this  
question has been asked already and the answer is that the session is  
a signed piece of data using an HMAC. This means that if an attacker  
tries to change the values in the session store that the signature  
will fail. The signature check in Rails will catch this and the user  
will see a 422 error. Try it!

Note that the session is only signed and not encrypted. So don’t  
store anything there that you don’t want the user to be able to see.  
It is only protected from modification and not protected from being  
seen.

Here is a good guide for further information.

[Securing Rails Applications — Ruby on Rails Guides](http://guides.rubyonrails.org/security.html)

Bob

---

<div class="post-metadata">

**Author:** ![ralphshnelvar](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e19adc/32.png) [@ralphshnelvar](https://www.ruby-forum.com/u/ralphshnelvar)\
**Post date:** [July 7, 2010, 12:54am UTC](https://www.ruby-forum.com/t/sessions-and-authorization/191172/3 "2010-07-07T00:54:13Z")

</div>

Bob P. wrote:

> Here is a good guide for further information.
> 
> [Securing Rails Applications — Ruby on Rails Guides](http://guides.rubyonrails.org/security.html)
> 
> Bob

I must have read that guide over the last sdevera; months a half a dozen  
times.

Your two-paragraph explanation made it snap into focus for me …  
finally!

Thanks!

Ralph