Class: Rack::Protection::SessionHijacking

### Home Classes Methods

### In Files

- lib/rack/protection/session_hijacking.rb

### Parent

Rack::Protection::Base

### Methods

- #accepts?
- #encrypt

### Class/Module Index

Quicksearch

- Rack
- Rack::Protection
- Rack::Protection::AuthenticityToken
- Rack::Protection::Base
- Rack::Protection::EscapedParams
- Rack::Protection::FormToken
- Rack::Protection::FrameOptions
- Rack::Protection::HttpOrigin
- Rack::Protection::IPSpoofing
- Rack::Protection::JsonCsrf
- Rack::Protection::PathTraversal
- Rack::Protection::RemoteReferrer
- Rack::Protection::RemoteToken
- Rack::Protection::SessionHijacking
- Rack::Protection::VERSION
- Rack::Protection::XSSHeader

No matching classes.

# Rack::Protection::SessionHijacking

Prevented attack | Session Hijacking
Supported browsers | all
More infos | en.wikipedia.org/wiki/Session_hijacking

Tracks request properties like the user agent in the session and empties the session if those properties change. This essentially prevents attacks from Firesheep. Since all headers taken into consideration might be spoofed, too, this will not prevent all hijacking attempts.

### Public Instance Methods

accepts?(env) click to toggle source

    # File lib/rack/protection/session_hijacking.rb, line 19
    def accepts?(env)
      session = session env
      key     = options[:tracking_key]
      if session.include? key
        session[key].all? { |k,v| v == encrypt(env[k]) }
      else
        session[key] = {}
        options[:track].each { |k| session[key][k] = encrypt(env[k]) }
      end
    end

encrypt(value) click to toggle source

    # File lib/rack/protection/session_hijacking.rb, line 30
    def encrypt(value)
      value = value.to_s.downcase
      options[:encrypt_tracking] ? super(value) : value
    end

[Validate]

Generated with the Darkfish Rdoc Generator 2.