Simple question about session...

Question

I came across this example from Ruby's security page (http://guides.rubyonrails.org/security.html). It poses this scenario:

• A user receives credits, the amount is stored in a session (which is a bad idea anyway, but we’ll do this for demonstration purposes).
• The user buys something.
• His new, lower credit will be stored in the session.
• The dark side of the user forces him to take the cookie from the first step (which he copied) and replace the current cookie in the browser.
• The user has his credit back.

I'm a little confused, as I always understood that the session cookie's value is merely an identifier for the server-controlled session state. This example is saying that the cookie's state controls the session's state and that states of session on the server are maintained over time.

Can someone explain this? Thanks.

Answer 1

That's true for server-side sessions, however this example is from 2.6 Replay Attacks for CookieStore Sessions. CookieStore stores what would usually be persisted in a server-side session in the cookie, and therefore on the client which makes it vunerable to the replay attack in the example.