Rails user switches session

I've got a Rails application开发者_如何转开发 running and it seems that every once in a while a user gets the cookie session_id value from a different user.

I use active_record_store to keep track of the session in Rails.

The current_user method:

def current_user
    @current_user ||= session[:user_id] ? User.find_by_id(session[:user_id]) : nil
    return @current_user
end

I run 8 ruby processes on a Windows machine using Apache 2.2.15. Sometimes it serves the incorrect session_id to the user. My rails version is 2.1.2

In the log file I can see the user changes session_id of a different user. For instance:

Processing Manage::TruckController#show (for 179.34.103.8 at 2011-05-12 07:35:24) [POST]
Session ID: 1fbc801bbade1007291901ca810bfeda1eab76
....
Completed

And 5 minutes later is would get a different session id, however belonging to a valid user.

Processing Manage::TruckController#edit (for 179.34.103.8 at 2011-05-12 07:40:01) [POST]
Session ID: 2f8e84c40c490c509feabbce9701aa9101ba0f
.... 
Completed

To me this seems that Rails is handing out incorrect session_id data to the cookie that is stored on the web browser of the user.

Any suggestions on this?

---

From looking at the code and the security guide, it seems like there is a slight possibility of MD5 collision. It's very unlikely that this would happen or be reproducible though, so I'm more inclined to say it has something to do with the browser testing.

I'd first make sure that your browser isn't serving up these bad session IDs by using a tool like Charles.

I also recommend using the cookie session whenever possible which would avoid this sort of problem.

Finally, since you're running a fairly old version of Rails it might be worth trying an upgrade. It's possible you're hitting an old bug.

---

I found this extremely useful. how-do-i-prevent-rails-users-from-accidentally-authenticating-as-the-wrong-user

If you are:

• destroying your database in development AND
• using the out-of-the-box Rails secret_token.rb

The client browser will have preserved a valid session containing a user_id that may or may not belong to that user.

I had a similar issue and resolved it using a code snippet similar to this comment by mdesantis on managing Rails secret token