Replay attacks with cookie session : Rails 2.0

Question

I'm using rails 2.0.5 with cookie session.

but cookie session has serious problem wis the possibility of replay attacks. How do I prevent replay attacs with cookie store?

I hope a plug in of Rails 2.0 use or concrete source example codes.

Could you help me?

more information more information

Answer 1

I think that the only way to prevent them is to use a SSL connection.

But I think you'll be safe even without one, as long as you don't store sensitive data (like passwords) in the session and make sure that you set a reasonable expiry time for them.

Answer 2

The cookie session store is no more susceptible to replay attacks than other rails session stores. While the cookie store holds encrypted session data in the cookie, other stores hold the session id - equally valuable to an attacker. This is also true in most web frameworks. Other than using SSL, I don't believe there is any way to prevent these attacks.