Devise has been reported to be vulnerable to CSRF token fixation attacks.<\/p>\n
The attack can only be exploited if the attacker can set the target session, either by subdomain cookies (similar to described here<\/a>) or by fixation over the same Wi-Fi network. If the user knows the CSRF token, cross-site forgery requests can be made. More information can be found here<\/a>.<\/p>\n Note Devise is not<\/strong> vulnerable to session fixation attacks (i.e. the user cannot steal another user session by fixating the session id).<\/p>\n Devise 3.0.1 and 2.2.5 have been released with fixes for the attack.<\/p>\n If you can’t upgrade, you must protect your Devise application by adding the next three lines to a Rails initializer:<\/p>\n Notice the code above and the updated Devise versions will clean up the CSRF Token after any authentication (sign in, sign up, reset password, etc). So if you are using AJAX for such features, you will need to fetch a new CSRF token from the server.<\/p>\n We want to thank Egor Homakov for reporting the issue and working with us on a fix.<\/p>\n","protected":false},"excerpt":{"rendered":" Devise has been reported to be vulnerable to CSRF token fixation attacks. The attack can only be exploited if the attacker can set the target session, either by subdomain cookies (similar to described here) or by fixation over the same Wi-Fi network. If the user knows the CSRF token, cross-site forgery requests can be made. … \u00bb<\/a><\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":""},"categories":[1],"tags":[36,7,124],"aioseo_notices":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/posts\/3536"}],"collection":[{"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/comments?post=3536"}],"version-history":[{"count":7,"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/posts\/3536\/revisions"}],"predecessor-version":[{"id":4218,"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/posts\/3536\/revisions\/4218"}],"wp:attachment":[{"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/media?parent=3536"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/categories?post=3536"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/tags?post=3536"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Releases<\/h3>\n
\nWarden::Manager.after_authentication do |record, warden, options|\n warden.request.session.try(:delete, :_csrf_token)\nend\n<\/pre>\n
Acknowledgements<\/h3>\n