Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
brevio-session-store
Advanced tools
A simple Redis-based session store for Rails. But why, you ask,
when there's redis-store?
redis-store is a one-size-fits-all solution, and I found it not to work
properly with Rails, mostly due to a problem that seemed to lie in
Rack's Abstract::ID
class. I wanted something that worked, so I
blatantly stole the code from Rails' MemCacheStore
and turned it
into a Redis version. No support for fancy stuff like distributed
storage across several Redis instances. Feel free to add what you
see fit.
This library doesn't offer anything related to caching, and is only suitable for Rails applications. For other frameworks or drop-in support for caching, check out redis-store.
For Rails 3+, adding this to your Gemfile
will do the trick.
gem 'redis-session-store'
See lib/redis-session-store.rb
for a list of valid options.
In your Rails app, throw in an initializer with the following contents:
Rails.application.config.session_store :redis_session_store, {
key: 'your_session_key',
redis: {
expire_after: 120.minutes, # cookie expiration
ttl: 120.minutes, # Redis expiration, defaults to 'expire_after'
key_prefix: 'myapp:session:',
url: 'redis://localhost:6379/0',
}
}
If you want to handle cases where Redis is unavailable, a custom
callable handler may be provided as on_redis_down
:
Rails.application.config.session_store :redis_session_store, {
# ... other options ...
on_redis_down: ->(e, env, sid) { do_something_will_ya!(e) }
redis: {
# ... redis options ...
}
}
By default the Marshal serializer is used. With Rails 4, you can use JSON as a custom serializer:
:json
- serialize cookie values with JSON
(Requires Rails 4+):marshal
- serialize cookie values with Marshal
(Default):hybrid
- transparently migrate existing Marshal
cookie values to JSON
(Requires Rails 4+)CustomClass
- You can just pass the constant name of any class that responds to .load
and .dump
Rails.application.config.session_store :redis_session_store, {
# ... other options ...
serializer: :hybrid
redis: {
# ... redis options ...
}
}
Note: Rails 4 is required for using the :json
and :hybrid
serializers
because the Flash
object doesn't serialize well in 3.2. See Rails #13945 for more info.
If you want to handle cases where the session data cannot be loaded, a
custom callable handler may be provided as on_session_load_error
which
will be given the error and the session ID.
Rails.application.config.session_store :redis_session_store, {
# ... other options ...
on_session_load_error: ->(e, sid) { do_something_will_ya!(e) }
redis: {
# ... redis options ...
}
}
Note The session will always be destroyed when it cannot be loaded.
It returns with_indifferent_access if ActiveSupport is defined
This gem is currently only compatible with Rails 3+. If you need Rails 2 compatibility, be sure to pin to a lower version like so:
gem 'redis-session-store', '< 0.3'
See CONTRIBUTING.md, AUTHORS.md, and LICENSE, respectively.
FAQs
Unknown package
We found that brevio-session-store demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.