Go Auth Urself
summary
Rails session format is dissected: keys are derived via PBKDF2-like key stretching and Rails uses ActiveSupport message verifier/encryptor to sign and optionally encrypt cookie blobs. A Marshal deserialization exploit lets an attacker with the secret token craft a cookie that executes arbitrary Ruby (dropped the DB in the demo). Practical fixes shown: switch to JSON/hybrid serializer migration to avoid Ruby objects, rotate secrets, and a Go library reproduces Rails signing so a Go service can create and verify compatible sessions.
AI-written summary · about
