regenerating session don't send a new cookie #762
Description
SessionMiddleware seems to ignore session regeneration. The middleware should reset the session cookie with a new id after session.regenerate(), but instead it continues to use the old cookie. This can be a security vulnerability because it allows session fixation attacks.
Here is a simple test case. The session id should change after logging in, but it doesn't.
use tide::sessions::{MemoryStore, SessionMiddleware};
use tide::{Redirect, Request, Response};
#[async_std::main]
async fn main() -> tide::Result<()> {
let mut app = tide::new();
app.with(SessionMiddleware::new(
MemoryStore::new(),
b"01234567890123456789012345678901",
));
app.at("/").get(index);
app.at("/login").get(login);
app.listen("127.0.0.1:8081").await?;
Ok(())
}
async fn index(req: Request<()>) -> tide::Result {
let session = req.session();
let user: String = session.get("user").unwrap_or("guest".to_string());
let mut resp: Response = format!(
r#"
Logged in as {}<br>
Session id: {}<br>
<a href="/login">Login</a>"#,
user,
session.id()
)
.into();
resp.set_content_type("text/html");
Ok(resp)
}
async fn login(mut req: Request<()>) -> tide::Result {
let session = req.session_mut();
session.regenerate();
session.insert("user", "admin")?;
Ok(Redirect::see_other("/").into())
}