fafhrd91/pyramid_sockjs — pull request #7 by hathawsh (2012-06-04 23:00:08+00:00)
Title: Prevent session hijacking

In pyramid_sockjs 0.3.5, if an attacker can find out a user's session ID, I believe the session can be hijacked. (The attacker can get the session ID through social engineering or by stealing server logs.)

The patch I am submitting should fix the hole. The patch changes the way pyramid_sockjs identifies sessions; this version looks up sessions by both user ID and session ID, making it impossible for an attacker to access another user's session without logging in as that user. The feature can be disabled by setting per_user=False.