rubygems/rubygems.org — pull request #552 by jsuder (2013-03-29 16:19:45+00:00)
Title: Use secure cookies

I've noticed that the auth cookie and session cookie are leaked on HTTP connections. This pull request should fix this.

How to reproduce:

1. log in to rubygems.org
2. start a packet sniffer in the console
3. go to http://rubygems.org (you'll be redirected to HTTPS)
4. you should see a header `Set-Cookie: remember_token=xxxxxxxxxxxx` in the captured response packet
5. load RubyGems in another browser with the cookie copied, or with curl like this: `curl https://rubygems.org/profile/edit -H "Cookie: remember_token=xxxxxxxxxx"`
6. you can now see that user's email and api token, change password etc.

If you start a sniffer while connected to a non-encrypted WiFi, you can steal someone else's session cookie this way. Not terribly probable as most people don't log in to RubyGems too often, but still theoretically it could happen.

The pull request marks the session cookie (less important) and the remember_token cookie that authenticates the user as secure cookies (using an option added in the latest version of Clearance). I had to do some additional fixes because quite a lot of other things were changed in Clearance since the previously used version.

I've also added an 'ssl' cookie that tells if the user is logged in, because there's no other way to check that now in HTTP requests, so without that change if you log in and then go to http://rubygems.org you'd simply see the home page and appear not to be logged in.