{"id":4996,"date":"2016-01-18T15:10:38","date_gmt":"2016-01-18T17:10:38","guid":{"rendered":"http:\/\/blog.plataformatec.com.br\/?p=4996"},"modified":"2016-01-18T15:10:38","modified_gmt":"2016-01-18T17:10:38","slug":"improve-remember-me-cookie-expiration-in-devise","status":"publish","type":"post","link":"http:\/\/blog.plataformatec.com.br\/2016\/01\/improve-remember-me-cookie-expiration-in-devise\/","title":{"rendered":"Improve remember me cookie expiration in Devise (CVE-2015-8314)"},"content":{"rendered":"<p>A security bug (CVE-2015-8314) has been reported in Devise&#8217;s remember me system.<\/p>\n<p>Devise implements the &#8220;Remember me&#8221; functionality by using cookies. While this functionality works across multiple devices, Devise ended-up generating the same cookie for all devices. Consequently, if a malicious user was able to steal a remember me cookie, the cookie could be used to gain access to the application indefinitely unless the user changed his password (which may not be a frequent event).<\/p>\n<p>Although all Devise versions are vulnerable to this bug, the bug can only be exploited if the attacker can steal cookies in the first place. Regardless, we recommend all users to upgrade to the latest Devise version.<\/p>\n<h2>Releases<\/h2>\n<p>Devise 3.5.4 has been released with a fix. This release adds a timestamp to the cookie, guaranteeing cookies can be expired on a case-by-case basis instead of an all or nothing approach.<\/p>\n<p>We also have made <a href=\"https:\/\/gist.github.com\/josevalim\/924ce7cc4c0e5039fd79\">a patch available for those running on older versions<\/a>.<\/p>\n<h2>Acknowledgements<\/h2>\n<p>We want to thank Alfredo Ramirez (bonds0097@gmail.com) from VSR for reporting the issue and working with us on a fix.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A security bug (CVE-2015-8314) has been reported in Devise&#8217;s remember me system. Devise implements the &#8220;Remember me&#8221; functionality by using cookies. While this functionality works across multiple devices, Devise ended-up generating the same cookie for all devices. Consequently, if a malicious user was able to steal a remember me cookie, the cookie could be used &#8230; <a class=\"read-more-link\" href=\"http:\/\/blog.plataformatec.com.br\/2016\/01\/improve-remember-me-cookie-expiration-in-devise\/\">\u00bb<\/a><\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":""},"categories":[1],"tags":[36,124],"aioseo_notices":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"http:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/posts\/4996"}],"collection":[{"href":"http:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/comments?post=4996"}],"version-history":[{"count":2,"href":"http:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/posts\/4996\/revisions"}],"predecessor-version":[{"id":4998,"href":"http:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/posts\/4996\/revisions\/4998"}],"wp:attachment":[{"href":"http:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/media?parent=4996"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/categories?post=4996"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/tags?post=4996"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}