281 - Enhance Security by Implementing reset_session in SubmittersController #282
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Janell-Huyck
changed the title
Janell-Huyck
changed the title
hortongn
requested changes
Nov 21, 2023
There was a problem hiding this comment.
@Janell-Huyck your specs still pass even when the reset_session is removed.
Fixed it. Thanks for checking! |
Janell-Huyck
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #281
Description
This PR introduces a crucial security enhancement to our SubmittersController by implementing the reset_session method. This change is designed to mitigate session fixation attacks, a type of security vulnerability where an attacker can potentially hijack a user's session.
Changes Made
Incorporated reset_session in the create action of the SubmittersController.
This change ensures that a new session is started every time a submitter account is created, invalidating any previously existing session identifiers.
Implementation Details
The reset_session method is called immediately before we set the new submitter_id in the session after successfully creating a new submitter.
This effectively clears any existing session data and establishes a new, clean session.
Testing
Added RSpec tests to verify that the old session is cleared and a new session is established with a new submitter_id after the creation of a new submitter.
Impact
This change adds an extra layer of security for our users and protects the integrity of their sessions, especially during the account creation process.
There are no expected impacts on performance or existing functionalities.