# Why is NFS insecure for storing open id sessions?

**URL:** <https://www.ruby-forum.com/t/why-is-nfs-insecure-for-storing-open-id-sessions/152931>\
**Category:** Rails\
**Created:** [November 10, 2008, 2:53am UTC](https://www.ruby-forum.com/t/why-is-nfs-insecure-for-storing-open-id-sessions/152931 "2008-11-10T02:53:11Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![benjohnson](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/3ec8ea/32.png) [@benjohnson](https://www.ruby-forum.com/u/benjohnson)\
**Post date:** [November 10, 2008, 2:53am UTC](https://www.ruby-forum.com/t/why-is-nfs-insecure-for-storing-open-id-sessions/152931/1 "2008-11-10T02:53:11Z")

</div>

I am trying to set up openid in my application. I came across this  
plugin:

> **[GitHub - rails/open\_id\_authentication: NOTICE: official repository moved to...](https://github.com/rails/open_id_authentication/tree/master)**
>
> master

In there it says:

“Alternatively, you can use the file-based store, which just relies on  
tmp/openids being present in RAILS\_ROOT. But be  
aware that this store only works if you have a single application  
server. And it’s not safe to use across NFS”

They never explain why its not safe. If NFS is used within your internal  
/ private network what is not safe about it?

I did some research and came up with nothing. Maybe someone here knows  
what they are talking about. Thanks!

---

<div class="post-metadata">

**Author:** ![benjohnson](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/3ec8ea/32.png) [@benjohnson](https://www.ruby-forum.com/u/benjohnson)\
**Post date:** [November 10, 2008, 10:11am UTC](https://www.ruby-forum.com/t/why-is-nfs-insecure-for-storing-open-id-sessions/152931/2 "2008-11-10T10:11:35Z")

</div>

On Nov 10, 1:53 am, Ben J. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> server. And it’s not safe to use across NFS"

I’d hazard a guess that “safe” refers to locking problems and so on  
rather than privacy concerns.

Fred

---

<div class="post-metadata">

**Author:** ![benjohnson](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/3ec8ea/32.png) [@benjohnson](https://www.ruby-forum.com/u/benjohnson)\
**Post date:** [November 11, 2008, 1:54pm UTC](https://www.ruby-forum.com/t/why-is-nfs-insecure-for-storing-open-id-sessions/152931/3 "2008-11-11T13:54:10Z")

</div>

Actually I believe NFS does file locking (I think it’d have to use  
locking to prevent contention between multiple devices).

I think that really what the Author is saying is that NFS traffic is  
transmitted in the clear. So if the network for NFS is viewable by  
others, they’d get your secure data just by sniffing the network. I’d  
bet they assume your NFS mount is across a public network.  
-Dale

On Nov 10, 3:09 am, Frederick C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![benjohnson](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/3ec8ea/32.png) [@benjohnson](https://www.ruby-forum.com/u/benjohnson)\
**Post date:** [November 11, 2008, 2:10pm UTC](https://www.ruby-forum.com/t/why-is-nfs-insecure-for-storing-open-id-sessions/152931/4 "2008-11-11T14:10:35Z")

</div>

On 11 Nov 2008, at 12:53, Dale wrote:

> Actually I believe NFS does file locking (I think it’d have to use  
> locking to prevent contention between multiple devices).

Quite possibly, but I wouldn’t bet that the file based store is doing  
that locking. The easiest way might be to ask on the rails-core list  
for clarification (would have thought it was fair game if it’s hosted  
at rails’ github account.

Fred