Rails / RSpec: reset_session does not change the value of the Set-Cookie HTTP header during integration tests

Question

I am writing an integration test to make sure my webapp is not vulnerable to session fixation.

I checked manually that reset_session actually runs in the authentication logic, and besides that the cookie really changes when I log in to my web browser (so that I am no longer vulnerable to commit the session), but I can’t get my RSpec integration test. to successfully verify this.

Here is my RSpec integration test.

 require 'spec_helper' describe "security" do self.use_transactional_fixtures = false append_after(:each) do ALL_MODELS.each &:delete_all end describe "session fixation" do it "should change the cookie session id after logging in" do u = test_user :active_user => true, :username => " [e-mail] ", :password => "asdfasdf" u.save! https! get_via_redirect "/login" assert_response :success cookie = response.header["Set-Cookie"].split(";").select{|x| x.match(/_session/)}[0].split("=")[1].strip post_via_redirect "/login", "user[email]" => " [e-mail] ", "user[password]" => "asdfasdf", "user[remember_me]" => "1" assert_response :success path.should eql("/dashboard") cookie.should_not eql(response.header["Set-Cookie"].split(";").select{|x| x.match(/_session/)}[0].split("=")[1].strip) end end end 

Everything works, except for the most recent statement. The cookie does not change.

Are there any known issues with RSpec / Rails integration tests where reset_session does not work as expected? What can I do to write a test that checks for session fixation is not a problem?

Answer 1

So, I finally figured it out.

I tried to edit the response header directly for checking cookies, but I think this is not a blessed way.

In integration tests with Rails 2.x, in any case, there is a hash cookie that you can use. Here is what the test ended:

  u = test_user :active_user => true, :username => " [e-mail] ", :password => "asdfasdf" u.save! https! get_via_redirect "/login" assert_response :success cookie = cookies['_session'] cookie.should be_present path.should == "/login" post_via_redirect "/login", "user[email]" => " [e-mail] ", "user[password]" => "asdfasdf", "user[remember_me]" => "1" assert_response :success path.should eql("/?login_success=1") new_cookie = cookies['_session'] new_cookie.should be_present cookie.should_not eql(new_cookie)