別端末からセッションハイジャックを防ぐ仕組みを導入

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 6aff4d2..2790713 100644 (file)
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -1,3 +1,4 @@
+# -*- coding: utf-8-hfs -*-
 # Filters added to this controller apply to all controllers in the application.
 # Likewise, all the methods added will be available for all controllers.
 
@@ -16,7 +17,9 @@ class ApplicationController < ActionController::Base
   # from your application log (in this case, all fields with names like "password"). 
   # filter_parameter_logging :password
   include ActiveRecordHelper
-
+  
+  # セッションハイジャック対策を導入
+  include CheckSessionSignature
 
   def load_system
     @system = System.find(:first)

diff --git a/config/environment.rb b/config/environment.rb
index 957505f..2a4af5e 100644 (file)
--- a/config/environment.rb
+++ b/config/environment.rb
@@ -60,6 +60,7 @@ require 'rexml-expansion-fix'
 require 'create_fixtures'
 require 'security_token'
 require 'csv_util'
+require 'check_session_signature'
 
 list = Dir["app/models/*.rb"]
 list.each do |i|

diff --git a/lib/check_session_signature.rb b/lib/check_session_signature.rb
new file mode 100644 (file)
index 0000000..f88a376
--- /dev/null
+++ b/lib/check_session_signature.rb
@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*-
+
+# CheckSessionSignature
+module CheckSessionSignature
+  ##　使い方:
+  ##   include CheckSessionSignature
+  
+  def self.included(base)
+    base.send :before_filter, :check_session_signature
+  end
+  
+  def check_session_signature
+    signature = Zlib.crc32([request.env['HTTP_USER_AGENT'].to_s,
+                            request.env['HTTP_X_MSIM_USE'].to_s,
+                            request.env['HTTP_X_UP_SUBNO'].to_s,
+                            request.env['HTTP_X_JPHONE_UID'].to_s,
+                            ].join('\1'))
+    session[:_signature] ||= signature
+    session_key = ActionController::Base.session_options.merge(request.session_options || {})[:key]
+    if params[session_key] && session[:_signature] != signature
+      logger.error('session hijack:%s from %s ' % [session.session_id, request.referer])
+      reset_session
+    end
+    true
+  end
+
+end