Accepting session_id generated on the outside, when using MemCacheStore as SessionStorage

In CGI::Session::MemCache,

When using MemCacheStore as SessionStorage, if we created invalid session_id on the outside and requested to rails-application including it, then, server accepts it and response Set-Cookie header including that session_id.

For example:

$ curl -I http://localhost:3000/?_sess=foobar

HTTP/1.1 200 Ok

Connection: close

Date: Tue, 08 Jul 2008 04:59:36 GMT

Set-Cookie: _sess=foobar; path=/

:(omit the rest)

This behavior might be misused by session fixation attacks.

I managed to do this trivially by changing my session ID in my cookie.

Not sure what the comment is saying. The problem isn't the session data being stored, it's that bad cookies can overwriting existing sessions. This just blew up for us with user auth where an issue with session ID generation caused multiple users to have cookies with the same session ID. Deleting the entry out of memcache was not a sufficient fix, because on the next request a session would be dutifully created based on the ID stored in the (now defunct) cookie.