Skip to content

Instantly share code, notes, and snippets.

@taktran
Created April 11, 2012 10:32
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save taktran/2358527 to your computer and use it in GitHub Desktop.
Save taktran/2358527 to your computer and use it in GitHub Desktop.
Rack protection bug

Server dumps of env.to_yaml to replicate the rack-protection bug. Only seems to be an issue with IE9, without set :protection, except: :session_hijacking set.

I have the following setup:

rack (1.4.1)
rack-force_domain (0.2.0)
rack-protection (1.2.0)

sinatra (1.3.2)
  rack (~> 1.3, >= 1.3.6)
  rack-protection (~> 1.2)
  tilt (~> 1.3, >= 1.3.3)
omniauth (1.0.3)
  hashie (~> 1.2)
  rack

omniauth-google-oauth2 (0.1.9)
  omniauth (~> 1.0)
  omniauth-oauth2
omniauth-oauth2 (1.0.0)
  oauth2 (~> 0.5.0)
  omniauth (~> 1.0)

Also for reference I have this stackoverflow question about it: http://stackoverflow.com/q/10102893/111884

IE9

Logging in with omniauth

Without set :protection, except: :session_hijacking

11:26:00 web.1     | attack prevented by Rack::Protection::SessionHijacking
11:26:22 web.1     | current_user? (true):
11:26:22 web.1     | ---
11:26:22 web.1     | SERVER_SOFTWARE: thin 1.3.1 codename Triple Espresso
11:26:22 web.1     | SERVER_NAME: localhost
11:26:22 web.1     | rack.input: !ruby/object:Rack::Lint::InputWrapper
11:26:22 web.1     |   input: !ruby/object:StringIO {}
11:26:22 web.1     | rack.version:
11:26:22 web.1     | - 1
11:26:22 web.1     | - 0
11:26:22 web.1     | rack.errors: &2177268240 !ruby/object:Rack::Lint::ErrorWrapper
11:26:22 web.1     |   error: !ruby/object:IO {}
11:26:22 web.1     | rack.multithread: false
11:26:22 web.1     | rack.multiprocess: false
11:26:22 web.1     | rack.run_once: false
11:26:22 web.1     | REQUEST_METHOD: GET
11:26:22 web.1     | REQUEST_PATH: /4f7c2ff5b01a52d961000002/2012/week/15
11:26:22 web.1     | PATH_INFO: /4f7c2ff5b01a52d961000002/2012/week/15
11:26:22 web.1     | REQUEST_URI: /4f7c2ff5b01a52d961000002/2012/week/15
11:26:22 web.1     | HTTP_VERSION: HTTP/1.1
11:26:22 web.1     | HTTP_ACCEPT: text/html, application/xhtml+xml, */*
11:26:22 web.1     | HTTP_COOKIE: rack.session=BAh7CEkiCHVpZAY6BkVGSSIaMTExOTY1Mjg4MDkzODI4NTA5Mjc1BjsAVEki%0AD3Nlc3Npb25faWQGOwBGIkU5OTMwY2NmZTdkMjIxNmZkOGNlZDFhY2Y3Zjlh%0ANzE2Mzc1NzRmYjY3ZDBlMjJkZGYwZjg1N2I0MGNhYjBhYjMwSSINdHJhY2tp%0AbmcGOwBGewhJIhRIVFRQX1VTRVJfQUdFTlQGOwBGIi1lOGY4ZmNmZTlhZWFm%0AMmFhY2I4NjcwOWQ3ZWUxODcyMzhmZDY3OTMwSSIZSFRUUF9BQ0NFUFRfRU5D%0AT0RJTkcGOwBGIi1hMGJmYzg3NmQ2OGZlN2FlYTcwMGRhNWVhODkyNWFiYWM2%0AZjJmNzk0SSIZSFRUUF9BQ0NFUFRfTEFOR1VBR0UGOwBGIi01YTdiZDQxNDlk%0AMGQzNGQzZWM4NjE4MWNkYWIxY2I4ZGQzZjQ0MWQ3%0A--ff680c644297b9e3af968ce8f1706c6314dc1da6
11:26:22 web.1     | HTTP_ACCEPT_LANGUAGE: en-US
11:26:22 web.1     | HTTP_USER_AGENT: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2;
11:26:22 web.1     |   .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0;
11:26:22 web.1     |   .NET4.0C; .NET4.0E)
11:26:22 web.1     | HTTP_ACCEPT_ENCODING: gzip, deflate
11:26:22 web.1     | HTTP_CONNECTION: Keep-Alive
11:26:22 web.1     | HTTP_CACHE_CONTROL: no-cache
11:26:22 web.1     | HTTP_HOST: localhost:6100
11:26:22 web.1     | GATEWAY_INTERFACE: CGI/1.2
11:26:22 web.1     | SERVER_PORT: '6100'
11:26:22 web.1     | QUERY_STRING: ''
11:26:22 web.1     | SERVER_PROTOCOL: HTTP/1.1
11:26:22 web.1     | rack.url_scheme: http
11:26:22 web.1     | SCRIPT_NAME: ''
11:26:22 web.1     | REMOTE_ADDR: 127.0.0.1
11:26:22 web.1     | async.callback: !ruby/object:Method {}
11:26:22 web.1     | async.close: !ruby/object:EventMachine::DefaultDeferrable {}
11:26:22 web.1     | rack.logger: !ruby/object:Logger
11:26:22 web.1     |   progname: !!null 
11:26:22 web.1     |   level: 1
11:26:22 web.1     |   default_formatter: !ruby/object:Logger::Formatter
11:26:22 web.1     |     datetime_format: !!null 
11:26:22 web.1     |   formatter: !ruby/object:Logger::SimpleFormatter
11:26:22 web.1     |     datetime_format: !!null 
11:26:22 web.1     |   logdev: !ruby/object:Logger::LogDevice
11:26:22 web.1     |     shift_size: !!null 
11:26:22 web.1     |     shift_age: !!null 
11:26:22 web.1     |     filename: !!null 
11:26:22 web.1     |     dev: *2177268240
11:26:22 web.1     |     mutex: !ruby/object:Logger::LogDevice::LogDeviceMutex
11:26:22 web.1     |       mon_owner: !!null 
11:26:22 web.1     |       mon_count: 0
11:26:22 web.1     |       mon_mutex: !ruby/object:Mutex {}
11:26:22 web.1     | rack.session:
11:26:22 web.1     |   uid: '111111'
11:26:22 web.1     |   session_id: 9930ccfe7d2216fd8ced1acf7f9a71637574fb67d0e22ddf0f857b40cab0ab30
11:26:22 web.1     |   tracking: &2177246360
11:26:22 web.1     |     HTTP_USER_AGENT: e8f8fcfe9aeaf2aacb86709d7ee187238fd67930
11:26:22 web.1     |     HTTP_ACCEPT_ENCODING: a0bfc876d68fe7aea700da5ea8925abac6f2f794
11:26:22 web.1     |     HTTP_ACCEPT_LANGUAGE: 5a7bd4149d0d34d3ec86181cdab1cb8dd3f441d7
11:26:22 web.1     | rack.session.options:
11:26:22 web.1     |   :path: /
11:26:22 web.1     |   :domain: !!null 
11:26:22 web.1     |   :expire_after: !!null 
11:26:22 web.1     |   :secure: false
11:26:22 web.1     |   :httponly: true
11:26:22 web.1     |   :defer: false
11:26:22 web.1     |   :renew: false
11:26:22 web.1     |   :sidbits: 128
11:26:22 web.1     |   :secure_random: !ruby/object:Module
11:26:22 web.1     |     pid: 38323
11:26:22 web.1     |   :secret: wj-Sf/sdf_P49usi#sn132_sdnfij3
11:26:22 web.1     |   :coder: !ruby/object:Rack::Session::Cookie::Base64::Marshal {}
11:26:22 web.1     |   :id: 9930ccfe7d2216fd8ced1acf7f9a71637574fb67d0e22ddf0f857b40cab0ab30
11:26:22 web.1     | rack.request.cookie_hash:
11:26:22 web.1     |   rack.session: ! 'BAh7CEkiCHVpZAY6BkVGSSIaMTExOTY1Mjg4MDkzODI4NTA5Mjc1BjsAVEki
11:26:22 web.1     | 
11:26:22 web.1     |     D3Nlc3Npb25faWQGOwBGIkU5OTMwY2NmZTdkMjIxNmZkOGNlZDFhY2Y3Zjlh
11:26:22 web.1     | 
11:26:22 web.1     |     NzE2Mzc1NzRmYjY3ZDBlMjJkZGYwZjg1N2I0MGNhYjBhYjMwSSINdHJhY2tp
11:26:22 web.1     | 
11:26:22 web.1     |     bmcGOwBGewhJIhRIVFRQX1VTRVJfQUdFTlQGOwBGIi1lOGY4ZmNmZTlhZWFm
11:26:22 web.1     | 
11:26:22 web.1     |     MmFhY2I4NjcwOWQ3ZWUxODcyMzhmZDY3OTMwSSIZSFRUUF9BQ0NFUFRfRU5D
11:26:22 web.1     | 
11:26:22 web.1     |     T0RJTkcGOwBGIi1hMGJmYzg3NmQ2OGZlN2FlYTcwMGRhNWVhODkyNWFiYWM2
11:26:22 web.1     | 
11:26:22 web.1     |     ZjJmNzk0SSIZSFRUUF9BQ0NFUFRfTEFOR1VBR0UGOwBGIi01YTdiZDQxNDlk
11:26:22 web.1     | 
11:26:22 web.1     |     MGQzNGQzZWM4NjE4MWNkYWIxY2I4ZGQzZjQ0MWQ3
11:26:22 web.1     | 
11:26:22 web.1     |     --ff680c644297b9e3af968ce8f1706c6314dc1da6'
11:26:22 web.1     | rack.request.cookie_string: rack.session=BAh7CEkiCHVpZAY6BkVGSSIaMTExOTY1Mjg4MDkzODI4NTA5Mjc1BjsAVEki%0AD3Nlc3Npb25faWQGOwBGIkU5OTMwY2NmZTdkMjIxNmZkOGNlZDFhY2Y3Zjlh%0ANzE2Mzc1NzRmYjY3ZDBlMjJkZGYwZjg1N2I0MGNhYjBhYjMwSSINdHJhY2tp%0AbmcGOwBGewhJIhRIVFRQX1VTRVJfQUdFTlQGOwBGIi1lOGY4ZmNmZTlhZWFm%0AMmFhY2I4NjcwOWQ3ZWUxODcyMzhmZDY3OTMwSSIZSFRUUF9BQ0NFUFRfRU5D%0AT0RJTkcGOwBGIi1hMGJmYzg3NmQ2OGZlN2FlYTcwMGRhNWVhODkyNWFiYWM2%0AZjJmNzk0SSIZSFRUUF9BQ0NFUFRfTEFOR1VBR0UGOwBGIi01YTdiZDQxNDlk%0AMGQzNGQzZWM4NjE4MWNkYWIxY2I4ZGQzZjQ0MWQ3%0A--ff680c644297b9e3af968ce8f1706c6314dc1da6
11:26:22 web.1     | rack.session.unpacked_cookie_data:
11:26:22 web.1     |   uid: '111111'
11:26:22 web.1     |   session_id: 9930ccfe7d2216fd8ced1acf7f9a71637574fb67d0e22ddf0f857b40cab0ab30
11:26:22 web.1     |   tracking: *2177246360
11:26:22 web.1     | rack.request.query_string: ''
11:26:22 web.1     | rack.request.query_hash: {}
11:26:22 web.1     | 

With set :protection, except: :session_hijacking

11:41:09 web.1     | current_user? (true):
11:41:09 web.1     | ---
11:41:09 web.1     | SERVER_SOFTWARE: thin 1.3.1 codename Triple Espresso
11:41:09 web.1     | SERVER_NAME: localhost
11:41:09 web.1     | rack.input: !ruby/object:Rack::Lint::InputWrapper
11:41:09 web.1     |   input: !ruby/object:StringIO {}
11:41:09 web.1     | rack.version:
11:41:09 web.1     | - 1
11:41:09 web.1     | - 0
11:41:09 web.1     | rack.errors: &2173904800 !ruby/object:Rack::Lint::ErrorWrapper
11:41:09 web.1     |   error: !ruby/object:IO {}
11:41:09 web.1     | rack.multithread: false
11:41:09 web.1     | rack.multiprocess: false
11:41:09 web.1     | rack.run_once: false
11:41:09 web.1     | REQUEST_METHOD: GET
11:41:09 web.1     | REQUEST_PATH: /4f7c2ff5b01a52d961000002/2012/week/15
11:41:09 web.1     | PATH_INFO: /4f7c2ff5b01a52d961000002/2012/week/15
11:41:09 web.1     | REQUEST_URI: /4f7c2ff5b01a52d961000002/2012/week/15
11:41:09 web.1     | HTTP_VERSION: HTTP/1.1
11:41:09 web.1     | HTTP_ACCEPT: text/html, application/xhtml+xml, */*
11:41:09 web.1     | HTTP_COOKIE: rack.session=BAh7CUkiD3Nlc3Npb25faWQGOgZFRiJFOTkzMGNjZmU3ZDIyMTZmZDhjZWQx%0AYWNmN2Y5YTcxNjM3NTc0ZmI2N2QwZTIyZGRmMGY4NTdiNDBjYWIwYWIzMEki%0ADXRyYWNraW5nBjsARnsISSIUSFRUUF9VU0VSX0FHRU5UBjsARiItNmExNjYx%0AZWZlM2M5MzZiNDlhNmViMGI3ZGZlYzhiMTk5MDkwNDI0NEkiGUhUVFBfQUND%0ARVBUX0VOQ09ESU5HBjsARiItYTBiZmM4NzZkNjhmZTdhZWE3MDBkYTVlYTg5%0AMjVhYmFjNmYyZjc5NEkiGUhUVFBfQUNDRVBUX0xBTkdVQUdFBjsARiItNWE3%0AYmQ0MTQ5ZDBkMzRkM2VjODYxODFjZGFiMWNiOGRkM2Y0NDFkN0kiCmZsYXNo%0ABjsARnsASSIIdWlkBjsARkkiGjExMTk2NTI4ODA5MzgyODUwOTI3NQY7AFQ%3D%0A--39b2910ae47d08a272b303b7f9de25f5c94d2b9a
11:41:09 web.1     | HTTP_ACCEPT_LANGUAGE: en-US
11:41:09 web.1     | HTTP_USER_AGENT: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2;
11:41:09 web.1     |   .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0;
11:41:09 web.1     |   .NET4.0C; .NET4.0E)
11:41:09 web.1     | HTTP_ACCEPT_ENCODING: gzip, deflate
11:41:09 web.1     | HTTP_CONNECTION: Keep-Alive
11:41:09 web.1     | HTTP_CACHE_CONTROL: no-cache
11:41:09 web.1     | HTTP_HOST: localhost:6100
11:41:09 web.1     | GATEWAY_INTERFACE: CGI/1.2
11:41:09 web.1     | SERVER_PORT: '6100'
11:41:09 web.1     | QUERY_STRING: ''
11:41:09 web.1     | SERVER_PROTOCOL: HTTP/1.1
11:41:09 web.1     | rack.url_scheme: http
11:41:09 web.1     | SCRIPT_NAME: ''
11:41:09 web.1     | REMOTE_ADDR: 127.0.0.1
11:41:09 web.1     | async.callback: !ruby/object:Method {}
11:41:09 web.1     | async.close: !ruby/object:EventMachine::DefaultDeferrable {}
11:41:09 web.1     | rack.logger: !ruby/object:Logger
11:41:09 web.1     |   progname: !!null 
11:41:09 web.1     |   level: 1
11:41:09 web.1     |   default_formatter: !ruby/object:Logger::Formatter
11:41:09 web.1     |     datetime_format: !!null 
11:41:09 web.1     |   formatter: !ruby/object:Logger::SimpleFormatter
11:41:09 web.1     |     datetime_format: !!null 
11:41:09 web.1     |   logdev: !ruby/object:Logger::LogDevice
11:41:09 web.1     |     shift_size: !!null 
11:41:09 web.1     |     shift_age: !!null 
11:41:09 web.1     |     filename: !!null 
11:41:09 web.1     |     dev: *2173904800
11:41:09 web.1     |     mutex: !ruby/object:Logger::LogDevice::LogDeviceMutex
11:41:09 web.1     |       mon_owner: !!null 
11:41:09 web.1     |       mon_count: 0
11:41:09 web.1     |       mon_mutex: !ruby/object:Mutex {}
11:41:09 web.1     | rack.session:
11:41:09 web.1     |   session_id: 9930ccfe7d2216fd8ced1acf7f9a71637574fb67d0e22ddf0f857b40cab0ab30
11:41:09 web.1     |   tracking: &2173823180
11:41:09 web.1     |     HTTP_USER_AGENT: 6a1661efe3c936b49a6eb0b7dfec8b1990904244
11:41:09 web.1     |     HTTP_ACCEPT_ENCODING: a0bfc876d68fe7aea700da5ea8925abac6f2f794
11:41:09 web.1     |     HTTP_ACCEPT_LANGUAGE: 5a7bd4149d0d34d3ec86181cdab1cb8dd3f441d7
11:41:09 web.1     |   flash: &2173821940 {}
11:41:09 web.1     |   uid: '111111'
11:41:09 web.1     | rack.session.options:
11:41:09 web.1     |   :path: /
11:41:09 web.1     |   :domain: !!null 
11:41:09 web.1     |   :expire_after: !!null 
11:41:09 web.1     |   :secure: false
11:41:09 web.1     |   :httponly: true
11:41:09 web.1     |   :defer: false
11:41:09 web.1     |   :renew: false
11:41:09 web.1     |   :sidbits: 128
11:41:09 web.1     |   :secure_random: !ruby/object:Module
11:41:09 web.1     |     pid: 38517
11:41:09 web.1     |   :secret: wj-Sf/sdf_P49usi#sn132_sdnfij3
11:41:09 web.1     |   :coder: !ruby/object:Rack::Session::Cookie::Base64::Marshal {}
11:41:09 web.1     |   :id: 9930ccfe7d2216fd8ced1acf7f9a71637574fb67d0e22ddf0f857b40cab0ab30
11:41:09 web.1     | rack.request.query_string: ''
11:41:09 web.1     | rack.request.query_hash: {}
11:41:09 web.1     | rack.request.cookie_hash:
11:41:09 web.1     |   rack.session: ! 'BAh7CUkiD3Nlc3Npb25faWQGOgZFRiJFOTkzMGNjZmU3ZDIyMTZmZDhjZWQx
11:41:09 web.1     | 
11:41:09 web.1     |     YWNmN2Y5YTcxNjM3NTc0ZmI2N2QwZTIyZGRmMGY4NTdiNDBjYWIwYWIzMEki
11:41:09 web.1     | 
11:41:09 web.1     |     DXRyYWNraW5nBjsARnsISSIUSFRUUF9VU0VSX0FHRU5UBjsARiItNmExNjYx
11:41:09 web.1     | 
11:41:09 web.1     |     ZWZlM2M5MzZiNDlhNmViMGI3ZGZlYzhiMTk5MDkwNDI0NEkiGUhUVFBfQUND
11:41:09 web.1     | 
11:41:09 web.1     |     RVBUX0VOQ09ESU5HBjsARiItYTBiZmM4NzZkNjhmZTdhZWE3MDBkYTVlYTg5
11:41:09 web.1     | 
11:41:09 web.1     |     MjVhYmFjNmYyZjc5NEkiGUhUVFBfQUNDRVBUX0xBTkdVQUdFBjsARiItNWE3
11:41:09 web.1     | 
11:41:09 web.1     |     YmQ0MTQ5ZDBkMzRkM2VjODYxODFjZGFiMWNiOGRkM2Y0NDFkN0kiCmZsYXNo
11:41:09 web.1     | 
11:41:09 web.1     |     BjsARnsASSIIdWlkBjsARkkiGjExMTk2NTI4ODA5MzgyODUwOTI3NQY7AFQ=
11:41:09 web.1     | 
11:41:09 web.1     |     --39b2910ae47d08a272b303b7f9de25f5c94d2b9a'
11:41:09 web.1     | rack.request.cookie_string: rack.session=BAh7CUkiD3Nlc3Npb25faWQGOgZFRiJFOTkzMGNjZmU3ZDIyMTZmZDhjZWQx%0AYWNmN2Y5YTcxNjM3NTc0ZmI2N2QwZTIyZGRmMGY4NTdiNDBjYWIwYWIzMEki%0ADXRyYWNraW5nBjsARnsISSIUSFRUUF9VU0VSX0FHRU5UBjsARiItNmExNjYx%0AZWZlM2M5MzZiNDlhNmViMGI3ZGZlYzhiMTk5MDkwNDI0NEkiGUhUVFBfQUND%0ARVBUX0VOQ09ESU5HBjsARiItYTBiZmM4NzZkNjhmZTdhZWE3MDBkYTVlYTg5%0AMjVhYmFjNmYyZjc5NEkiGUhUVFBfQUNDRVBUX0xBTkdVQUdFBjsARiItNWE3%0AYmQ0MTQ5ZDBkMzRkM2VjODYxODFjZGFiMWNiOGRkM2Y0NDFkN0kiCmZsYXNo%0ABjsARnsASSIIdWlkBjsARkkiGjExMTk2NTI4ODA5MzgyODUwOTI3NQY7AFQ%3D%0A--39b2910ae47d08a272b303b7f9de25f5c94d2b9a
11:41:09 web.1     | rack.session.unpacked_cookie_data:
11:41:09 web.1     |   session_id: 9930ccfe7d2216fd8ced1acf7f9a71637574fb67d0e22ddf0f857b40cab0ab30
11:41:09 web.1     |   tracking: *2173823180
11:41:09 web.1     |   flash: *2173821940
11:41:09 web.1     |   uid: '111111'
11:41:09 web.1     | 

Going to another page after login

Without set :protection, except: :session_hijacking (session is destroyed)

11:26:29 web.1     | attack prevented by Rack::Protection::SessionHijacking
11:27:03 web.1     | current_user? (false):
11:27:03 web.1     | ---
11:27:03 web.1     | SERVER_SOFTWARE: thin 1.3.1 codename Triple Espresso
11:27:03 web.1     | SERVER_NAME: localhost
11:27:03 web.1     | rack.input: !ruby/object:Rack::Lint::InputWrapper
11:27:03 web.1     |   input: !ruby/object:StringIO {}
11:27:03 web.1     | rack.version:
11:27:03 web.1     | - 1
11:27:03 web.1     | - 0
11:27:03 web.1     | rack.errors: &2171385980 !ruby/object:Rack::Lint::ErrorWrapper
11:27:03 web.1     |   error: !ruby/object:IO {}
11:27:03 web.1     | rack.multithread: false
11:27:03 web.1     | rack.multiprocess: false
11:27:03 web.1     | rack.run_once: false
11:27:03 web.1     | REQUEST_METHOD: GET
11:27:03 web.1     | REQUEST_PATH: /4f7c2ff5b01a52d961000002/2012/week/16
11:27:03 web.1     | PATH_INFO: /4f7c2ff5b01a52d961000002/2012/week/16
11:27:03 web.1     | REQUEST_URI: /4f7c2ff5b01a52d961000002/2012/week/16
11:27:03 web.1     | HTTP_VERSION: HTTP/1.1
11:27:03 web.1     | HTTP_ACCEPT: text/html, application/xhtml+xml, */*
11:27:03 web.1     | HTTP_REFERER: http://localhost:6100/4f7c2ff5b01a52d961000002/2012/week/15
11:27:03 web.1     | HTTP_ACCEPT_LANGUAGE: en-US
11:27:03 web.1     | HTTP_USER_AGENT: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
11:27:03 web.1     | HTTP_ACCEPT_ENCODING: gzip, deflate
11:27:03 web.1     | HTTP_HOST: localhost:6100
11:27:03 web.1     | HTTP_CONNECTION: Keep-Alive
11:27:03 web.1     | HTTP_COOKIE: rack.session=BAh7BkkiD3Nlc3Npb25faWQGOgZFRiJFOTkzMGNjZmU3ZDIyMTZmZDhjZWQx%0AYWNmN2Y5YTcxNjM3NTc0ZmI2N2QwZTIyZGRmMGY4NTdiNDBjYWIwYWIzMA%3D%3D%0A--d0842adc8d5cb15a6f0be9de79b132de95ee8a72
11:27:03 web.1     | GATEWAY_INTERFACE: CGI/1.2
11:27:03 web.1     | SERVER_PORT: '6100'
11:27:03 web.1     | QUERY_STRING: ''
11:27:03 web.1     | SERVER_PROTOCOL: HTTP/1.1
11:27:03 web.1     | rack.url_scheme: http
11:27:03 web.1     | SCRIPT_NAME: ''
11:27:03 web.1     | REMOTE_ADDR: 127.0.0.1
11:27:03 web.1     | async.callback: !ruby/object:Method {}
11:27:03 web.1     | async.close: !ruby/object:EventMachine::DefaultDeferrable {}
11:27:03 web.1     | rack.logger: !ruby/object:Logger
11:27:03 web.1     |   progname: !!null 
11:27:03 web.1     |   level: 1
11:27:03 web.1     |   default_formatter: !ruby/object:Logger::Formatter
11:27:03 web.1     |     datetime_format: !!null 
11:27:03 web.1     |   formatter: !ruby/object:Logger::SimpleFormatter
11:27:03 web.1     |     datetime_format: !!null 
11:27:03 web.1     |   logdev: !ruby/object:Logger::LogDevice
11:27:03 web.1     |     shift_size: !!null 
11:27:03 web.1     |     shift_age: !!null 
11:27:03 web.1     |     filename: !!null 
11:27:03 web.1     |     dev: *2171385980
11:27:03 web.1     |     mutex: !ruby/object:Logger::LogDevice::LogDeviceMutex
11:27:03 web.1     |       mon_owner: !!null 
11:27:03 web.1     |       mon_count: 0
11:27:03 web.1     |       mon_mutex: !ruby/object:Mutex {}
11:27:03 web.1     | rack.session:
11:27:03 web.1     |   session_id: 9930ccfe7d2216fd8ced1acf7f9a71637574fb67d0e22ddf0f857b40cab0ab30
11:27:03 web.1     |   tracking:
11:27:03 web.1     |     HTTP_USER_AGENT: 6a1661efe3c936b49a6eb0b7dfec8b1990904244
11:27:03 web.1     |     HTTP_ACCEPT_ENCODING: a0bfc876d68fe7aea700da5ea8925abac6f2f794
11:27:03 web.1     |     HTTP_ACCEPT_LANGUAGE: 5a7bd4149d0d34d3ec86181cdab1cb8dd3f441d7
11:27:03 web.1     | rack.session.options:
11:27:03 web.1     |   :path: /
11:27:03 web.1     |   :domain: !!null 
11:27:03 web.1     |   :expire_after: !!null 
11:27:03 web.1     |   :secure: false
11:27:03 web.1     |   :httponly: true
11:27:03 web.1     |   :defer: false
11:27:03 web.1     |   :renew: false
11:27:03 web.1     |   :sidbits: 128
11:27:03 web.1     |   :secure_random: !ruby/object:Module
11:27:03 web.1     |     pid: 38334
11:27:03 web.1     |   :secret: wj-Sf/sdf_P49usi#sn132_sdnfij3
11:27:03 web.1     |   :coder: !ruby/object:Rack::Session::Cookie::Base64::Marshal {}
11:27:03 web.1     |   :id: 9930ccfe7d2216fd8ced1acf7f9a71637574fb67d0e22ddf0f857b40cab0ab30
11:27:03 web.1     | rack.request.cookie_hash:
11:27:03 web.1     |   rack.session: ! 'BAh7BkkiD3Nlc3Npb25faWQGOgZFRiJFOTkzMGNjZmU3ZDIyMTZmZDhjZWQx
11:27:03 web.1     | 
11:27:03 web.1     |     YWNmN2Y5YTcxNjM3NTc0ZmI2N2QwZTIyZGRmMGY4NTdiNDBjYWIwYWIzMA==
11:27:03 web.1     | 
11:27:03 web.1     |     --d0842adc8d5cb15a6f0be9de79b132de95ee8a72'
11:27:03 web.1     | rack.request.cookie_string: rack.session=BAh7BkkiD3Nlc3Npb25faWQGOgZFRiJFOTkzMGNjZmU3ZDIyMTZmZDhjZWQx%0AYWNmN2Y5YTcxNjM3NTc0ZmI2N2QwZTIyZGRmMGY4NTdiNDBjYWIwYWIzMA%3D%3D%0A--d0842adc8d5cb15a6f0be9de79b132de95ee8a72
11:27:03 web.1     | rack.session.unpacked_cookie_data:
11:27:03 web.1     |   session_id: 9930ccfe7d2216fd8ced1acf7f9a71637574fb67d0e22ddf0f857b40cab0ab30
11:27:03 web.1     | rack.request.query_string: ''
11:27:03 web.1     | rack.request.query_hash: {}
11:27:03 web.1     | 

With set :protection, except: :session_hijacking

11:41:44 web.1     | current_user? (true):
11:41:44 web.1     | ---
11:41:44 web.1     | SERVER_SOFTWARE: thin 1.3.1 codename Triple Espresso
11:41:44 web.1     | SERVER_NAME: localhost
11:41:44 web.1     | rack.input: !ruby/object:Rack::Lint::InputWrapper
11:41:44 web.1     |   input: !ruby/object:StringIO {}
11:41:44 web.1     | rack.version:
11:41:44 web.1     | - 1
11:41:44 web.1     | - 0
11:41:44 web.1     | rack.errors: &2171060520 !ruby/object:Rack::Lint::ErrorWrapper
11:41:44 web.1     |   error: !ruby/object:IO {}
11:41:44 web.1     | rack.multithread: false
11:41:44 web.1     | rack.multiprocess: false
11:41:44 web.1     | rack.run_once: false
11:41:44 web.1     | REQUEST_METHOD: GET
11:41:44 web.1     | REQUEST_PATH: /4f7c2ff5b01a52d961000002/2012/week/16
11:41:44 web.1     | PATH_INFO: /4f7c2ff5b01a52d961000002/2012/week/16
11:41:44 web.1     | REQUEST_URI: /4f7c2ff5b01a52d961000002/2012/week/16
11:41:44 web.1     | HTTP_VERSION: HTTP/1.1
11:41:44 web.1     | HTTP_ACCEPT: text/html, application/xhtml+xml, */*
11:41:44 web.1     | HTTP_REFERER: http://localhost:6100/4f7c2ff5b01a52d961000002/2012/week/15
11:41:44 web.1     | HTTP_ACCEPT_LANGUAGE: en-US
11:41:44 web.1     | HTTP_USER_AGENT: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
11:41:44 web.1     | HTTP_ACCEPT_ENCODING: gzip, deflate
11:41:44 web.1     | HTTP_HOST: localhost:6100
11:41:44 web.1     | HTTP_CONNECTION: Keep-Alive
11:41:44 web.1     | HTTP_COOKIE: rack.session=BAh7CUkiD3Nlc3Npb25faWQGOgZFRiJFOTkzMGNjZmU3ZDIyMTZmZDhjZWQx%0AYWNmN2Y5YTcxNjM3NTc0ZmI2N2QwZTIyZGRmMGY4NTdiNDBjYWIwYWIzMEki%0ADXRyYWNraW5nBjsARnsISSIUSFRUUF9VU0VSX0FHRU5UBjsARiItNmExNjYx%0AZWZlM2M5MzZiNDlhNmViMGI3ZGZlYzhiMTk5MDkwNDI0NEkiGUhUVFBfQUND%0ARVBUX0VOQ09ESU5HBjsARiItYTBiZmM4NzZkNjhmZTdhZWE3MDBkYTVlYTg5%0AMjVhYmFjNmYyZjc5NEkiGUhUVFBfQUNDRVBUX0xBTkdVQUdFBjsARiItNWE3%0AYmQ0MTQ5ZDBkMzRkM2VjODYxODFjZGFiMWNiOGRkM2Y0NDFkN0kiCmZsYXNo%0ABjsARnsASSIIdWlkBjsARkkiGjExMTk2NTI4ODA5MzgyODUwOTI3NQY7AFQ%3D%0A--39b2910ae47d08a272b303b7f9de25f5c94d2b9a
11:41:44 web.1     | GATEWAY_INTERFACE: CGI/1.2
11:41:44 web.1     | SERVER_PORT: '6100'
11:41:44 web.1     | QUERY_STRING: ''
11:41:44 web.1     | SERVER_PROTOCOL: HTTP/1.1
11:41:44 web.1     | rack.url_scheme: http
11:41:44 web.1     | SCRIPT_NAME: ''
11:41:44 web.1     | REMOTE_ADDR: 127.0.0.1
11:41:44 web.1     | async.callback: !ruby/object:Method {}
11:41:44 web.1     | async.close: !ruby/object:EventMachine::DefaultDeferrable {}
11:41:44 web.1     | rack.logger: !ruby/object:Logger
11:41:44 web.1     |   progname: !!null 
11:41:44 web.1     |   level: 1
11:41:44 web.1     |   default_formatter: !ruby/object:Logger::Formatter
11:41:44 web.1     |     datetime_format: !!null 
11:41:44 web.1     |   formatter: !ruby/object:Logger::SimpleFormatter
11:41:44 web.1     |     datetime_format: !!null 
11:41:44 web.1     |   logdev: !ruby/object:Logger::LogDevice
11:41:44 web.1     |     shift_size: !!null 
11:41:44 web.1     |     shift_age: !!null 
11:41:44 web.1     |     filename: !!null 
11:41:44 web.1     |     dev: *2171060520
11:41:44 web.1     |     mutex: !ruby/object:Logger::LogDevice::LogDeviceMutex
11:41:44 web.1     |       mon_owner: !!null 
11:41:44 web.1     |       mon_count: 0
11:41:44 web.1     |       mon_mutex: !ruby/object:Mutex {}
11:41:44 web.1     | rack.session:
11:41:44 web.1     |   session_id: 9930ccfe7d2216fd8ced1acf7f9a71637574fb67d0e22ddf0f857b40cab0ab30
11:41:44 web.1     |   tracking: &2171016460
11:41:44 web.1     |     HTTP_USER_AGENT: 6a1661efe3c936b49a6eb0b7dfec8b1990904244
11:41:44 web.1     |     HTTP_ACCEPT_ENCODING: a0bfc876d68fe7aea700da5ea8925abac6f2f794
11:41:44 web.1     |     HTTP_ACCEPT_LANGUAGE: 5a7bd4149d0d34d3ec86181cdab1cb8dd3f441d7
11:41:44 web.1     |   flash: &2171015200 {}
11:41:44 web.1     |   uid: '111111'
11:41:44 web.1     | rack.session.options:
11:41:44 web.1     |   :path: /
11:41:44 web.1     |   :domain: !!null 
11:41:44 web.1     |   :expire_after: !!null 
11:41:44 web.1     |   :secure: false
11:41:44 web.1     |   :httponly: true
11:41:44 web.1     |   :defer: false
11:41:44 web.1     |   :renew: false
11:41:44 web.1     |   :sidbits: 128
11:41:44 web.1     |   :secure_random: !ruby/object:Module
11:41:44 web.1     |     pid: 38526
11:41:44 web.1     |   :secret: wj-Sf/sdf_P49usi#sn132_sdnfij3
11:41:44 web.1     |   :coder: !ruby/object:Rack::Session::Cookie::Base64::Marshal {}
11:41:44 web.1     |   :id: 9930ccfe7d2216fd8ced1acf7f9a71637574fb67d0e22ddf0f857b40cab0ab30
11:41:44 web.1     | rack.request.query_string: ''
11:41:44 web.1     | rack.request.query_hash: {}
11:41:44 web.1     | rack.request.cookie_hash:
11:41:44 web.1     |   rack.session: ! 'BAh7CUkiD3Nlc3Npb25faWQGOgZFRiJFOTkzMGNjZmU3ZDIyMTZmZDhjZWQx
11:41:44 web.1     | 
11:41:44 web.1     |     YWNmN2Y5YTcxNjM3NTc0ZmI2N2QwZTIyZGRmMGY4NTdiNDBjYWIwYWIzMEki
11:41:44 web.1     | 
11:41:44 web.1     |     DXRyYWNraW5nBjsARnsISSIUSFRUUF9VU0VSX0FHRU5UBjsARiItNmExNjYx
11:41:44 web.1     | 
11:41:44 web.1     |     ZWZlM2M5MzZiNDlhNmViMGI3ZGZlYzhiMTk5MDkwNDI0NEkiGUhUVFBfQUND
11:41:44 web.1     | 
11:41:44 web.1     |     RVBUX0VOQ09ESU5HBjsARiItYTBiZmM4NzZkNjhmZTdhZWE3MDBkYTVlYTg5
11:41:44 web.1     | 
11:41:44 web.1     |     MjVhYmFjNmYyZjc5NEkiGUhUVFBfQUNDRVBUX0xBTkdVQUdFBjsARiItNWE3
11:41:44 web.1     | 
11:41:44 web.1     |     YmQ0MTQ5ZDBkMzRkM2VjODYxODFjZGFiMWNiOGRkM2Y0NDFkN0kiCmZsYXNo
11:41:44 web.1     | 
11:41:44 web.1     |     BjsARnsASSIIdWlkBjsARkkiGjExMTk2NTI4ODA5MzgyODUwOTI3NQY7AFQ=
11:41:44 web.1     | 
11:41:44 web.1     |     --39b2910ae47d08a272b303b7f9de25f5c94d2b9a'
11:41:44 web.1     | rack.request.cookie_string: rack.session=BAh7CUkiD3Nlc3Npb25faWQGOgZFRiJFOTkzMGNjZmU3ZDIyMTZmZDhjZWQx%0AYWNmN2Y5YTcxNjM3NTc0ZmI2N2QwZTIyZGRmMGY4NTdiNDBjYWIwYWIzMEki%0ADXRyYWNraW5nBjsARnsISSIUSFRUUF9VU0VSX0FHRU5UBjsARiItNmExNjYx%0AZWZlM2M5MzZiNDlhNmViMGI3ZGZlYzhiMTk5MDkwNDI0NEkiGUhUVFBfQUND%0ARVBUX0VOQ09ESU5HBjsARiItYTBiZmM4NzZkNjhmZTdhZWE3MDBkYTVlYTg5%0AMjVhYmFjNmYyZjc5NEkiGUhUVFBfQUNDRVBUX0xBTkdVQUdFBjsARiItNWE3%0AYmQ0MTQ5ZDBkMzRkM2VjODYxODFjZGFiMWNiOGRkM2Y0NDFkN0kiCmZsYXNo%0ABjsARnsASSIIdWlkBjsARkkiGjExMTk2NTI4ODA5MzgyODUwOTI3NQY7AFQ%3D%0A--39b2910ae47d08a272b303b7f9de25f5c94d2b9a
11:41:44 web.1     | rack.session.unpacked_cookie_data:
11:41:44 web.1     |   session_id: 9930ccfe7d2216fd8ced1acf7f9a71637574fb67d0e22ddf0f857b40cab0ab30
11:41:44 web.1     |   tracking: *2171016460
11:41:44 web.1     |   flash: *2171015200
11:41:44 web.1     |   uid: '111111'
11:41:44 web.1     | 

IE8

Both without set :protection, except: :session_hijacking

Logging in with omniauth

11:54:32 web.1     | current_user? (true):
11:54:32 web.1     | ---
11:54:32 web.1     | SERVER_SOFTWARE: thin 1.3.1 codename Triple Espresso
11:54:32 web.1     | SERVER_NAME: something.com
11:54:32 web.1     | rack.input: !ruby/object:Rack::Lint::InputWrapper
11:54:32 web.1     |   input: !ruby/object:StringIO {}
11:54:32 web.1     | rack.version:
11:54:32 web.1     | - 1
11:54:32 web.1     | - 0
11:54:32 web.1     | rack.errors: &2177284120 !ruby/object:Rack::Lint::ErrorWrapper
11:54:32 web.1     |   error: !ruby/object:IO {}
11:54:32 web.1     | rack.multithread: false
11:54:32 web.1     | rack.multiprocess: false
11:54:32 web.1     | rack.run_once: false
11:54:32 web.1     | REQUEST_METHOD: GET
11:54:32 web.1     | REQUEST_PATH: /4f7c2ff5b01a52d961000002/2012/week/15
11:54:32 web.1     | PATH_INFO: /4f7c2ff5b01a52d961000002/2012/week/15
11:54:32 web.1     | REQUEST_URI: /4f7c2ff5b01a52d961000002/2012/week/15
11:54:32 web.1     | HTTP_VERSION: HTTP/1.1
11:54:32 web.1     | HTTP_ACCEPT: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash,
11:54:32 web.1     |   application/x-silverlight, */*
11:54:32 web.1     | HTTP_COOKIE: rack.session=BAh7CUkiD3Nlc3Npb25faWQGOgZFRiJFNGNlOGVjMTI0MDdlMGQwZTk2OTcx%0AY2I3NWM5NmU5YTNlNmI1NDE5ZjZlNGRmYmQzOWMzMDRjMGRmZmVlMzRjZUki%0ACmZsYXNoBjsARnsASSINdHJhY2tpbmcGOwBGewhJIhRIVFRQX1VTRVJfQUdF%0ATlQGOwBGIi1iZWU4Yjg3NjMyZDkwNGIzODEzZjliYjAzYjI1YzNmNjJlNzFi%0AZjI1SSIZSFRUUF9BQ0NFUFRfRU5DT0RJTkcGOwBGIi1hMGJmYzg3NmQ2OGZl%0AN2FlYTcwMGRhNWVhODkyNWFiYWM2ZjJmNzk0SSIZSFRUUF9BQ0NFUFRfTEFO%0AR1VBR0UGOwBGIi0xMDgwYzhmZDY0MjcyYmQ4NTk2ZmYyODIzMDc1YzA1Mzlj%0AYzQzZDhhSSIIdWlkBjsARkkiGjExMTk2NTI4ODA5MzgyODUwOTI3NQY7AFQ%3D%0A--4927ceed4c0888fc312dd664e22a75ce21581918;
11:54:32 web.1     |   __utma=80905232.1367588777.1334141487.1334141487.1334141487.1; __utmb=80905232.3.10.1334141487;
11:54:32 web.1     |   __utmc=80905232; __utmz=80905232.1334141487.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
11:54:32 web.1     | HTTP_ACCEPT_LANGUAGE: en-us
11:54:32 web.1     | HTTP_USER_AGENT: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET
11:54:32 web.1     |   CLR 1.1.4322)
11:54:32 web.1     | HTTP_ACCEPT_ENCODING: gzip, deflate
11:54:32 web.1     | HTTP_CONNECTION: Keep-Alive
11:54:32 web.1     | HTTP_CACHE_CONTROL: no-cache
11:54:32 web.1     | HTTP_HOST: something.com:6100
11:54:32 web.1     | GATEWAY_INTERFACE: CGI/1.2
11:54:32 web.1     | SERVER_PORT: '6100'
11:54:32 web.1     | QUERY_STRING: ''
11:54:32 web.1     | SERVER_PROTOCOL: HTTP/1.1
11:54:32 web.1     | rack.url_scheme: http
11:54:32 web.1     | SCRIPT_NAME: ''
11:54:32 web.1     | REMOTE_ADDR: 127.0.0.1
11:54:32 web.1     | async.callback: !ruby/object:Method {}
11:54:32 web.1     | async.close: !ruby/object:EventMachine::DefaultDeferrable {}
11:54:32 web.1     | rack.logger: !ruby/object:Logger
11:54:32 web.1     |   progname: !!null 
11:54:32 web.1     |   level: 1
11:54:32 web.1     |   default_formatter: !ruby/object:Logger::Formatter
11:54:32 web.1     |     datetime_format: !!null 
11:54:32 web.1     |   formatter: !ruby/object:Logger::SimpleFormatter
11:54:32 web.1     |     datetime_format: !!null 
11:54:32 web.1     |   logdev: !ruby/object:Logger::LogDevice
11:54:32 web.1     |     shift_size: !!null 
11:54:32 web.1     |     shift_age: !!null 
11:54:32 web.1     |     filename: !!null 
11:54:32 web.1     |     dev: *2177284120
11:54:32 web.1     |     mutex: !ruby/object:Logger::LogDevice::LogDeviceMutex
11:54:32 web.1     |       mon_owner: !!null 
11:54:32 web.1     |       mon_count: 0
11:54:32 web.1     |       mon_mutex: !ruby/object:Mutex {}
11:54:32 web.1     | rack.session:
11:54:32 web.1     |   session_id: 4ce8ec12407e0d0e96971cb75c96e9a3e6b5419f6e4dfbd39c304c0dffee34ce
11:54:32 web.1     |   flash: &2177268460 {}
11:54:32 web.1     |   tracking: &2177268400
11:54:32 web.1     |     HTTP_USER_AGENT: bee8b87632d904b3813f9bb03b25c3f62e71bf25
11:54:32 web.1     |     HTTP_ACCEPT_ENCODING: a0bfc876d68fe7aea700da5ea8925abac6f2f794
11:54:32 web.1     |     HTTP_ACCEPT_LANGUAGE: 1080c8fd64272bd8596ff2823075c0539cc43d8a
11:54:32 web.1     |   uid: '111111'
11:54:32 web.1     | rack.session.options:
11:54:32 web.1     |   :path: /
11:54:32 web.1     |   :domain: !!null 
11:54:32 web.1     |   :expire_after: !!null 
11:54:32 web.1     |   :secure: false
11:54:32 web.1     |   :httponly: true
11:54:32 web.1     |   :defer: false
11:54:32 web.1     |   :renew: false
11:54:32 web.1     |   :sidbits: 128
11:54:32 web.1     |   :secure_random: !ruby/object:Module
11:54:32 web.1     |     pid: 38682
11:54:32 web.1     |   :secret: wj-Sf/sdf_P49usi#sn132_sdnfij3
11:54:32 web.1     |   :coder: !ruby/object:Rack::Session::Cookie::Base64::Marshal {}
11:54:32 web.1     |   :id: 4ce8ec12407e0d0e96971cb75c96e9a3e6b5419f6e4dfbd39c304c0dffee34ce
11:54:32 web.1     | rack.request.cookie_hash:
11:54:32 web.1     |   rack.session: ! 'BAh7CUkiD3Nlc3Npb25faWQGOgZFRiJFNGNlOGVjMTI0MDdlMGQwZTk2OTcx
11:54:32 web.1     | 
11:54:32 web.1     |     Y2I3NWM5NmU5YTNlNmI1NDE5ZjZlNGRmYmQzOWMzMDRjMGRmZmVlMzRjZUki
11:54:32 web.1     | 
11:54:32 web.1     |     CmZsYXNoBjsARnsASSINdHJhY2tpbmcGOwBGewhJIhRIVFRQX1VTRVJfQUdF
11:54:32 web.1     | 
11:54:32 web.1     |     TlQGOwBGIi1iZWU4Yjg3NjMyZDkwNGIzODEzZjliYjAzYjI1YzNmNjJlNzFi
11:54:32 web.1     | 
11:54:32 web.1     |     ZjI1SSIZSFRUUF9BQ0NFUFRfRU5DT0RJTkcGOwBGIi1hMGJmYzg3NmQ2OGZl
11:54:32 web.1     | 
11:54:32 web.1     |     N2FlYTcwMGRhNWVhODkyNWFiYWM2ZjJmNzk0SSIZSFRUUF9BQ0NFUFRfTEFO
11:54:32 web.1     | 
11:54:32 web.1     |     R1VBR0UGOwBGIi0xMDgwYzhmZDY0MjcyYmQ4NTk2ZmYyODIzMDc1YzA1Mzlj
11:54:32 web.1     | 
11:54:32 web.1     |     YzQzZDhhSSIIdWlkBjsARkkiGjExMTk2NTI4ODA5MzgyODUwOTI3NQY7AFQ=
11:54:32 web.1     | 
11:54:32 web.1     |     --4927ceed4c0888fc312dd664e22a75ce21581918'
11:54:32 web.1     |   __utma: 80905232.1367588777.1334141487.1334141487.1334141487.1
11:54:32 web.1     |   __utmb: 80905232.3.10.1334141487
11:54:32 web.1     |   __utmc: '80905232'
11:54:32 web.1     |   __utmz: 80905232.1334141487.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
11:54:32 web.1     | rack.request.cookie_string: rack.session=BAh7CUkiD3Nlc3Npb25faWQGOgZFRiJFNGNlOGVjMTI0MDdlMGQwZTk2OTcx%0AY2I3NWM5NmU5YTNlNmI1NDE5ZjZlNGRmYmQzOWMzMDRjMGRmZmVlMzRjZUki%0ACmZsYXNoBjsARnsASSINdHJhY2tpbmcGOwBGewhJIhRIVFRQX1VTRVJfQUdF%0ATlQGOwBGIi1iZWU4Yjg3NjMyZDkwNGIzODEzZjliYjAzYjI1YzNmNjJlNzFi%0AZjI1SSIZSFRUUF9BQ0NFUFRfRU5DT0RJTkcGOwBGIi1hMGJmYzg3NmQ2OGZl%0AN2FlYTcwMGRhNWVhODkyNWFiYWM2ZjJmNzk0SSIZSFRUUF9BQ0NFUFRfTEFO%0AR1VBR0UGOwBGIi0xMDgwYzhmZDY0MjcyYmQ4NTk2ZmYyODIzMDc1YzA1Mzlj%0AYzQzZDhhSSIIdWlkBjsARkkiGjExMTk2NTI4ODA5MzgyODUwOTI3NQY7AFQ%3D%0A--4927ceed4c0888fc312dd664e22a75ce21581918;
11:54:32 web.1     |   __utma=80905232.1367588777.1334141487.1334141487.1334141487.1; __utmb=80905232.3.10.1334141487;
11:54:32 web.1     |   __utmc=80905232; __utmz=80905232.1334141487.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
11:54:32 web.1     | rack.session.unpacked_cookie_data:
11:54:32 web.1     |   session_id: 4ce8ec12407e0d0e96971cb75c96e9a3e6b5419f6e4dfbd39c304c0dffee34ce
11:54:32 web.1     |   flash: *2177268460
11:54:32 web.1     |   tracking: *2177268400
11:54:32 web.1     |   uid: '111111'
11:54:32 web.1     | rack.request.query_string: ''
11:54:32 web.1     | rack.request.query_hash: {}
11:54:32 web.1     | 

Going to another page after login (session is retained)

11:57:17 web.1     | current_user? (true):
11:57:17 web.1     | ---
11:57:17 web.1     | SERVER_SOFTWARE: thin 1.3.1 codename Triple Espresso
11:57:17 web.1     | SERVER_NAME: something.com
11:57:17 web.1     | rack.input: !ruby/object:Rack::Lint::InputWrapper
11:57:17 web.1     |   input: !ruby/object:StringIO {}
11:57:17 web.1     | rack.version:
11:57:17 web.1     | - 1
11:57:17 web.1     | - 0
11:57:17 web.1     | rack.errors: &2170918720 !ruby/object:Rack::Lint::ErrorWrapper
11:57:17 web.1     |   error: !ruby/object:IO {}
11:57:17 web.1     | rack.multithread: false
11:57:17 web.1     | rack.multiprocess: false
11:57:17 web.1     | rack.run_once: false
11:57:17 web.1     | REQUEST_METHOD: GET
11:57:17 web.1     | REQUEST_PATH: /4f7c2ff5b01a52d961000002/2012/week/16
11:57:17 web.1     | PATH_INFO: /4f7c2ff5b01a52d961000002/2012/week/16
11:57:17 web.1     | REQUEST_URI: /4f7c2ff5b01a52d961000002/2012/week/16
11:57:17 web.1     | HTTP_VERSION: HTTP/1.1
11:57:17 web.1     | HTTP_ACCEPT: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash,
11:57:17 web.1     |   application/x-silverlight, */*
11:57:17 web.1     | HTTP_REFERER: http://something.com:6100/4f7c2ff5b01a52d961000002/2012/week/15
11:57:17 web.1     | HTTP_ACCEPT_LANGUAGE: en-us
11:57:17 web.1     | HTTP_USER_AGENT: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET
11:57:17 web.1     |   CLR 1.1.4322)
11:57:17 web.1     | HTTP_ACCEPT_ENCODING: gzip, deflate
11:57:17 web.1     | HTTP_HOST: something.com:6100
11:57:17 web.1     | HTTP_CONNECTION: Keep-Alive
11:57:17 web.1     | HTTP_COOKIE: rack.session=BAh7CUkiD3Nlc3Npb25faWQGOgZFRiJFNGNlOGVjMTI0MDdlMGQwZTk2OTcx%0AY2I3NWM5NmU5YTNlNmI1NDE5ZjZlNGRmYmQzOWMzMDRjMGRmZmVlMzRjZUki%0ACmZsYXNoBjsARnsASSINdHJhY2tpbmcGOwBGewhJIhRIVFRQX1VTRVJfQUdF%0ATlQGOwBGIi1iZWU4Yjg3NjMyZDkwNGIzODEzZjliYjAzYjI1YzNmNjJlNzFi%0AZjI1SSIZSFRUUF9BQ0NFUFRfRU5DT0RJTkcGOwBGIi1hMGJmYzg3NmQ2OGZl%0AN2FlYTcwMGRhNWVhODkyNWFiYWM2ZjJmNzk0SSIZSFRUUF9BQ0NFUFRfTEFO%0AR1VBR0UGOwBGIi0xMDgwYzhmZDY0MjcyYmQ4NTk2ZmYyODIzMDc1YzA1Mzlj%0AYzQzZDhhSSIIdWlkBjsARkkiGjExMTk2NTI4ODA5MzgyODUwOTI3NQY7AFQ%3D%0A--4927ceed4c0888fc312dd664e22a75ce21581918;
11:57:17 web.1     |   __utma=80905232.1367588777.1334141487.1334141487.1334141487.1; __utmb=80905232.4.10.1334141487;
11:57:17 web.1     |   __utmc=80905232; __utmz=80905232.1334141487.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
11:57:17 web.1     | GATEWAY_INTERFACE: CGI/1.2
11:57:17 web.1     | SERVER_PORT: '6100'
11:57:17 web.1     | QUERY_STRING: ''
11:57:17 web.1     | SERVER_PROTOCOL: HTTP/1.1
11:57:17 web.1     | rack.url_scheme: http
11:57:17 web.1     | SCRIPT_NAME: ''
11:57:17 web.1     | REMOTE_ADDR: 127.0.0.1
11:57:17 web.1     | async.callback: !ruby/object:Method {}
11:57:17 web.1     | async.close: !ruby/object:EventMachine::DefaultDeferrable {}
11:57:17 web.1     | rack.logger: !ruby/object:Logger
11:57:17 web.1     |   progname: !!null 
11:57:17 web.1     |   level: 1
11:57:17 web.1     |   default_formatter: !ruby/object:Logger::Formatter
11:57:17 web.1     |     datetime_format: !!null 
11:57:17 web.1     |   formatter: !ruby/object:Logger::SimpleFormatter
11:57:17 web.1     |     datetime_format: !!null 
11:57:19 web.1     |   logdev: !ruby/object:Logger::LogDevice
11:57:19 web.1     |     shift_size: !!null 
11:57:19 web.1     |     shift_age: !!null 
11:57:19 web.1     |     filename: !!null 
11:57:19 web.1     |     dev: *2170918720
11:57:19 web.1     |     mutex: !ruby/object:Logger::LogDevice::LogDeviceMutex
11:57:19 web.1     |       mon_owner: !!null 
11:57:19 web.1     |       mon_count: 0
11:57:19 web.1     |       mon_mutex: !ruby/object:Mutex {}
11:57:19 web.1     | rack.session:
11:57:19 web.1     |   session_id: 4ce8ec12407e0d0e96971cb75c96e9a3e6b5419f6e4dfbd39c304c0dffee34ce
11:57:19 web.1     |   flash: &2170904280 {}
11:57:19 web.1     |   tracking: &2170904180
11:57:19 web.1     |     HTTP_USER_AGENT: bee8b87632d904b3813f9bb03b25c3f62e71bf25
11:57:19 web.1     |     HTTP_ACCEPT_ENCODING: a0bfc876d68fe7aea700da5ea8925abac6f2f794
11:57:19 web.1     |     HTTP_ACCEPT_LANGUAGE: 1080c8fd64272bd8596ff2823075c0539cc43d8a
11:57:19 web.1     |   uid: '111111'
11:57:19 web.1     | rack.session.options:
11:57:19 web.1     |   :path: /
11:57:19 web.1     |   :domain: !!null 
11:57:19 web.1     |   :expire_after: !!null 
11:57:19 web.1     |   :secure: false
11:57:19 web.1     |   :httponly: true
11:57:19 web.1     |   :defer: false
11:57:19 web.1     |   :renew: false
11:57:19 web.1     |   :sidbits: 128
11:57:19 web.1     |   :secure_random: !ruby/object:Module
11:57:19 web.1     |     pid: 38713
11:57:19 web.1     |   :secret: wj-Sf/sdf_P49usi#sn132_sdnfij3
11:57:19 web.1     |   :coder: !ruby/object:Rack::Session::Cookie::Base64::Marshal {}
11:57:19 web.1     |   :id: 4ce8ec12407e0d0e96971cb75c96e9a3e6b5419f6e4dfbd39c304c0dffee34ce
11:57:19 web.1     | rack.request.cookie_hash:
11:57:19 web.1     |   rack.session: ! 'BAh7CUkiD3Nlc3Npb25faWQGOgZFRiJFNGNlOGVjMTI0MDdlMGQwZTk2OTcx
11:57:19 web.1     | 
11:57:19 web.1     |     Y2I3NWM5NmU5YTNlNmI1NDE5ZjZlNGRmYmQzOWMzMDRjMGRmZmVlMzRjZUki
11:57:19 web.1     | 
11:57:19 web.1     |     CmZsYXNoBjsARnsASSINdHJhY2tpbmcGOwBGewhJIhRIVFRQX1VTRVJfQUdF
11:57:19 web.1     | 
11:57:19 web.1     |     TlQGOwBGIi1iZWU4Yjg3NjMyZDkwNGIzODEzZjliYjAzYjI1YzNmNjJlNzFi
11:57:19 web.1     | 
11:57:19 web.1     |     ZjI1SSIZSFRUUF9BQ0NFUFRfRU5DT0RJTkcGOwBGIi1hMGJmYzg3NmQ2OGZl
11:57:19 web.1     | 
11:57:19 web.1     |     N2FlYTcwMGRhNWVhODkyNWFiYWM2ZjJmNzk0SSIZSFRUUF9BQ0NFUFRfTEFO
11:57:19 web.1     | 
11:57:19 web.1     |     R1VBR0UGOwBGIi0xMDgwYzhmZDY0MjcyYmQ4NTk2ZmYyODIzMDc1YzA1Mzlj
11:57:19 web.1     | 
11:57:19 web.1     |     YzQzZDhhSSIIdWlkBjsARkkiGjExMTk2NTI4ODA5MzgyODUwOTI3NQY7AFQ=
11:57:19 web.1     | 
11:57:19 web.1     |     --4927ceed4c0888fc312dd664e22a75ce21581918'
11:57:19 web.1     |   __utma: 80905232.1367588777.1334141487.1334141487.1334141487.1
11:57:19 web.1     |   __utmb: 80905232.4.10.1334141487
11:57:19 web.1     |   __utmc: '80905232'
11:57:19 web.1     |   __utmz: 80905232.1334141487.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
11:57:19 web.1     | rack.request.cookie_string: rack.session=BAh7CUkiD3Nlc3Npb25faWQGOgZFRiJFNGNlOGVjMTI0MDdlMGQwZTk2OTcx%0AY2I3NWM5NmU5YTNlNmI1NDE5ZjZlNGRmYmQzOWMzMDRjMGRmZmVlMzRjZUki%0ACmZsYXNoBjsARnsASSINdHJhY2tpbmcGOwBGewhJIhRIVFRQX1VTRVJfQUdF%0ATlQGOwBGIi1iZWU4Yjg3NjMyZDkwNGIzODEzZjliYjAzYjI1YzNmNjJlNzFi%0AZjI1SSIZSFRUUF9BQ0NFUFRfRU5DT0RJTkcGOwBGIi1hMGJmYzg3NmQ2OGZl%0AN2FlYTcwMGRhNWVhODkyNWFiYWM2ZjJmNzk0SSIZSFRUUF9BQ0NFUFRfTEFO%0AR1VBR0UGOwBGIi0xMDgwYzhmZDY0MjcyYmQ4NTk2ZmYyODIzMDc1YzA1Mzlj%0AYzQzZDhhSSIIdWlkBjsARkkiGjExMTk2NTI4ODA5MzgyODUwOTI3NQY7AFQ%3D%0A--4927ceed4c0888fc312dd664e22a75ce21581918;
11:57:19 web.1     |   __utma=80905232.1367588777.1334141487.1334141487.1334141487.1; __utmb=80905232.4.10.1334141487;
11:57:19 web.1     |   __utmc=80905232; __utmz=80905232.1334141487.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
11:57:19 web.1     | rack.session.unpacked_cookie_data:
11:57:19 web.1     |   session_id: 4ce8ec12407e0d0e96971cb75c96e9a3e6b5419f6e4dfbd39c304c0dffee34ce
11:57:19 web.1     |   flash: *2170904280
11:57:19 web.1     |   tracking: *2170904180
11:57:19 web.1     |   uid: '111111'
11:57:19 web.1     | rack.request.query_string: ''
11:57:19 web.1     | rack.request.query_hash: {}
11:57:19 web.1     | 

Chrome

Both without set :protection, except: :session_hijacking

Logging in with omniauth

11:36:08 web.1     | current_user? (true):
11:36:08 web.1     | ---
11:36:08 web.1     | SERVER_SOFTWARE: thin 1.3.1 codename Triple Espresso
11:36:08 web.1     | SERVER_NAME: localhost
11:36:08 web.1     | rack.input: !ruby/object:Rack::Lint::InputWrapper
11:36:08 web.1     |   input: !ruby/object:StringIO {}
11:36:08 web.1     | rack.version:
11:36:08 web.1     | - 1
11:36:08 web.1     | - 0
11:36:08 web.1     | rack.errors: &2174309380 !ruby/object:Rack::Lint::ErrorWrapper
11:36:08 web.1     |   error: !ruby/object:IO {}
11:36:08 web.1     | rack.multithread: false
11:36:08 web.1     | rack.multiprocess: false
11:36:08 web.1     | rack.run_once: false
11:36:08 web.1     | REQUEST_METHOD: GET
11:36:08 web.1     | REQUEST_PATH: /4f7c2ff5b01a52d961000002/2012/week/15
11:36:08 web.1     | PATH_INFO: /4f7c2ff5b01a52d961000002/2012/week/15
11:36:08 web.1     | REQUEST_URI: /4f7c2ff5b01a52d961000002/2012/week/15
11:36:09 web.1     | HTTP_VERSION: HTTP/1.1
11:36:09 web.1     | HTTP_HOST: localhost:6100
11:36:09 web.1     | HTTP_CONNECTION: keep-alive
11:36:09 web.1     | HTTP_CACHE_CONTROL: max-age=0
11:36:09 web.1     | HTTP_AUTHORIZATION: Basic dmlzdGF6bzp2aXN0YXpv
11:36:09 web.1     | HTTP_USER_AGENT: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/535.19
11:36:09 web.1     |   (KHTML, like Gecko) Chrome/18.0.1025.151 Safari/535.19
11:36:09 web.1     | HTTP_ACCEPT: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
11:36:09 web.1     | HTTP_ACCEPT_ENCODING: gzip,deflate,sdch
11:36:09 web.1     | HTTP_ACCEPT_LANGUAGE: en-US,en;q=0.8
11:36:09 web.1     | HTTP_ACCEPT_CHARSET: ISO-8859-1,utf-8;q=0.7,*;q=0.3
11:36:09 web.1     | HTTP_COOKIE: rack.session=BAh7CkkiD3Nlc3Npb25faWQGOgZFRiJFZTQ4YzRiY2FhMjA2YzNlMjY3MzIz%0AYTY3ZjFkZTgxMjFmYTQxYTUwZDU2YWJlNGM0YjdkZWViMjA0MjE1ZGFmNEki%0ADXRyYWNraW5nBjsARnsISSIUSFRUUF9VU0VSX0FHRU5UBjsARiItNDRlNGE1%0AYTI1ZTlmYWRlODM1MmMyODg0MDM3NWJiZmJhZTE2OGE4ZkkiGUhUVFBfQUND%0ARVBUX0VOQ09ESU5HBjsARiItZWQyYjNjYTkwYTRlNzIzNDAyMzY3YTFkMTdj%0AOGIyODM5Mjg0MjM5OEkiGUhUVFBfQUNDRVBUX0xBTkdVQUdFBjsARiItY2M5%0AZjZmZWM2NTJhNDI1OGJjNmQyOTI4NzA1MjE3OWFiMWUwZDE0N0kiCmZsYXNo%0ABjsARnsASSIJY3NyZgY7AEYiRTBjNjI4ODdmNDM2YzRhNzJjM2Q3YWFjNzgw%0ANTc1OWQzZWNkNTQwOTVmNDhmNDU0ZTQ0YTAxMDkwM2RlNGQzN2RJIgh1aWQG%0AOwBGSSIaMTExOTY1Mjg4MDkzODI4NTA5Mjc1BjsAVA%3D%3D%0A--df8ffed7fb510b145d057b6c06a4f0c2d64c3917
11:36:09 web.1     | GATEWAY_INTERFACE: CGI/1.2
11:36:09 web.1     | SERVER_PORT: '6100'
11:36:09 web.1     | QUERY_STRING: ''
11:36:09 web.1     | SERVER_PROTOCOL: HTTP/1.1
11:36:09 web.1     | rack.url_scheme: http
11:36:09 web.1     | SCRIPT_NAME: ''
11:36:09 web.1     | REMOTE_ADDR: 127.0.0.1
11:36:09 web.1     | async.callback: !ruby/object:Method {}
11:36:09 web.1     | async.close: !ruby/object:EventMachine::DefaultDeferrable {}
11:36:09 web.1     | rack.logger: !ruby/object:Logger
11:36:09 web.1     |   progname: !!null 
11:36:09 web.1     |   level: 1
11:36:09 web.1     |   default_formatter: !ruby/object:Logger::Formatter
11:36:09 web.1     |     datetime_format: !!null 
11:36:09 web.1     |   formatter: !ruby/object:Logger::SimpleFormatter
11:36:09 web.1     |     datetime_format: !!null 
11:36:09 web.1     |   logdev: !ruby/object:Logger::LogDevice
11:36:09 web.1     |     shift_size: !!null 
11:36:09 web.1     |     shift_age: !!null 
11:36:09 web.1     |     filename: !!null 
11:36:09 web.1     |     dev: *2174309380
11:36:09 web.1     |     mutex: !ruby/object:Logger::LogDevice::LogDeviceMutex
11:36:09 web.1     |       mon_owner: !!null 
11:36:09 web.1     |       mon_count: 0
11:36:09 web.1     |       mon_mutex: !ruby/object:Mutex {}
11:36:09 web.1     | rack.session:
11:36:09 web.1     |   session_id: e48c4bcaa206c3e267323a67f1de8121fa41a50d56abe4c4b7deeb204215daf4
11:36:09 web.1     |   tracking: &2174301860
11:36:09 web.1     |     HTTP_USER_AGENT: 44e4a5a25e9fade8352c28840375bbfbae168a8f
11:36:09 web.1     |     HTTP_ACCEPT_ENCODING: ed2b3ca90a4e723402367a1d17c8b28392842398
11:36:09 web.1     |     HTTP_ACCEPT_LANGUAGE: cc9f6fec652a4258bc6d29287052179ab1e0d147
11:36:09 web.1     |   flash: &2174301220 {}
11:36:09 web.1     |   csrf: 0c62887f436c4a72c3d7aac7805759d3ecd54095f48f454e44a010903de4d37d
11:36:09 web.1     |   uid: '111111'
11:36:09 web.1     | rack.session.options:
11:36:09 web.1     |   :path: /
11:36:09 web.1     |   :domain: !!null 
11:36:09 web.1     |   :expire_after: !!null 
11:36:09 web.1     |   :secure: false
11:36:09 web.1     |   :httponly: true
11:36:09 web.1     |   :defer: false
11:36:09 web.1     |   :renew: false
11:36:09 web.1     |   :sidbits: 128
11:36:09 web.1     |   :secure_random: !ruby/object:Module
11:36:09 web.1     |     pid: 38452
11:36:09 web.1     |   :secret: wj-Sf/sdf_P49usi#sn132_sdnfij3
11:36:09 web.1     |   :coder: !ruby/object:Rack::Session::Cookie::Base64::Marshal {}
11:36:09 web.1     |   :id: e48c4bcaa206c3e267323a67f1de8121fa41a50d56abe4c4b7deeb204215daf4
11:36:09 web.1     | rack.request.cookie_hash:
11:36:09 web.1     |   rack.session: ! 'BAh7CkkiD3Nlc3Npb25faWQGOgZFRiJFZTQ4YzRiY2FhMjA2YzNlMjY3MzIz
11:36:09 web.1     | 
11:36:09 web.1     |     YTY3ZjFkZTgxMjFmYTQxYTUwZDU2YWJlNGM0YjdkZWViMjA0MjE1ZGFmNEki
11:36:09 web.1     | 
11:36:09 web.1     |     DXRyYWNraW5nBjsARnsISSIUSFRUUF9VU0VSX0FHRU5UBjsARiItNDRlNGE1
11:36:09 web.1     | 
11:36:09 web.1     |     YTI1ZTlmYWRlODM1MmMyODg0MDM3NWJiZmJhZTE2OGE4ZkkiGUhUVFBfQUND
11:36:09 web.1     | 
11:36:09 web.1     |     RVBUX0VOQ09ESU5HBjsARiItZWQyYjNjYTkwYTRlNzIzNDAyMzY3YTFkMTdj
11:36:09 web.1     | 
11:36:09 web.1     |     OGIyODM5Mjg0MjM5OEkiGUhUVFBfQUNDRVBUX0xBTkdVQUdFBjsARiItY2M5
11:36:09 web.1     | 
11:36:09 web.1     |     ZjZmZWM2NTJhNDI1OGJjNmQyOTI4NzA1MjE3OWFiMWUwZDE0N0kiCmZsYXNo
11:36:09 web.1     | 
11:36:09 web.1     |     BjsARnsASSIJY3NyZgY7AEYiRTBjNjI4ODdmNDM2YzRhNzJjM2Q3YWFjNzgw
11:36:09 web.1     | 
11:36:09 web.1     |     NTc1OWQzZWNkNTQwOTVmNDhmNDU0ZTQ0YTAxMDkwM2RlNGQzN2RJIgh1aWQG
11:36:09 web.1     | 
11:36:09 web.1     |     OwBGSSIaMTExOTY1Mjg4MDkzODI4NTA5Mjc1BjsAVA==
11:36:09 web.1     | 
11:36:09 web.1     |     --df8ffed7fb510b145d057b6c06a4f0c2d64c3917'
11:36:09 web.1     | rack.request.cookie_string: rack.session=BAh7CkkiD3Nlc3Npb25faWQGOgZFRiJFZTQ4YzRiY2FhMjA2YzNlMjY3MzIz%0AYTY3ZjFkZTgxMjFmYTQxYTUwZDU2YWJlNGM0YjdkZWViMjA0MjE1ZGFmNEki%0ADXRyYWNraW5nBjsARnsISSIUSFRUUF9VU0VSX0FHRU5UBjsARiItNDRlNGE1%0AYTI1ZTlmYWRlODM1MmMyODg0MDM3NWJiZmJhZTE2OGE4ZkkiGUhUVFBfQUND%0ARVBUX0VOQ09ESU5HBjsARiItZWQyYjNjYTkwYTRlNzIzNDAyMzY3YTFkMTdj%0AOGIyODM5Mjg0MjM5OEkiGUhUVFBfQUNDRVBUX0xBTkdVQUdFBjsARiItY2M5%0AZjZmZWM2NTJhNDI1OGJjNmQyOTI4NzA1MjE3OWFiMWUwZDE0N0kiCmZsYXNo%0ABjsARnsASSIJY3NyZgY7AEYiRTBjNjI4ODdmNDM2YzRhNzJjM2Q3YWFjNzgw%0ANTc1OWQzZWNkNTQwOTVmNDhmNDU0ZTQ0YTAxMDkwM2RlNGQzN2RJIgh1aWQG%0AOwBGSSIaMTExOTY1Mjg4MDkzODI4NTA5Mjc1BjsAVA%3D%3D%0A--df8ffed7fb510b145d057b6c06a4f0c2d64c3917
11:36:09 web.1     | rack.session.unpacked_cookie_data:
11:36:09 web.1     |   session_id: e48c4bcaa206c3e267323a67f1de8121fa41a50d56abe4c4b7deeb204215daf4
11:36:09 web.1     |   tracking: *2174301860
11:36:09 web.1     |   flash: *2174301220
11:36:09 web.1     |   csrf: 0c62887f436c4a72c3d7aac7805759d3ecd54095f48f454e44a010903de4d37d
11:36:09 web.1     |   uid: '111111'
11:36:09 web.1     | rack.request.query_string: ''
11:36:09 web.1     | rack.request.query_hash: {}
11:36:09 web.1     | 

Going to another page after login (session is retained)

11:36:41 web.1     | current_user? (true):
11:36:41 web.1     | ---
11:36:41 web.1     | SERVER_SOFTWARE: thin 1.3.1 codename Triple Espresso
11:36:41 web.1     | SERVER_NAME: localhost
11:36:41 web.1     | rack.input: !ruby/object:Rack::Lint::InputWrapper
11:36:41 web.1     |   input: !ruby/object:StringIO {}
11:36:41 web.1     | rack.version:
11:36:41 web.1     | - 1
11:36:41 web.1     | - 0
11:36:41 web.1     | rack.errors: &2173887660 !ruby/object:Rack::Lint::ErrorWrapper
11:36:41 web.1     |   error: !ruby/object:IO {}
11:36:41 web.1     | rack.multithread: false
11:36:41 web.1     | rack.multiprocess: false
11:36:41 web.1     | rack.run_once: false
11:36:41 web.1     | REQUEST_METHOD: GET
11:36:41 web.1     | REQUEST_PATH: /4f7c2ff5b01a52d961000002/2012/week/16
11:36:41 web.1     | PATH_INFO: /4f7c2ff5b01a52d961000002/2012/week/16
11:36:41 web.1     | REQUEST_URI: /4f7c2ff5b01a52d961000002/2012/week/16
11:36:41 web.1     | HTTP_VERSION: HTTP/1.1
11:36:41 web.1     | HTTP_HOST: localhost:6100
11:36:41 web.1     | HTTP_CONNECTION: keep-alive
11:36:41 web.1     | HTTP_AUTHORIZATION: Basic dmlzdGF6bzp2aXN0YXpv
11:36:41 web.1     | HTTP_USER_AGENT: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/535.19
11:36:41 web.1     |   (KHTML, like Gecko) Chrome/18.0.1025.151 Safari/535.19
11:36:41 web.1     | HTTP_ACCEPT: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
11:36:41 web.1     | HTTP_REFERER: http://localhost:6100/4f7c2ff5b01a52d961000002/2012/week/15
11:36:41 web.1     | HTTP_ACCEPT_ENCODING: gzip,deflate,sdch
11:36:41 web.1     | HTTP_ACCEPT_LANGUAGE: en-US,en;q=0.8
11:36:41 web.1     | HTTP_ACCEPT_CHARSET: ISO-8859-1,utf-8;q=0.7,*;q=0.3
11:36:41 web.1     | HTTP_COOKIE: rack.session=BAh7CkkiD3Nlc3Npb25faWQGOgZFRiJFZTQ4YzRiY2FhMjA2YzNlMjY3MzIz%0AYTY3ZjFkZTgxMjFmYTQxYTUwZDU2YWJlNGM0YjdkZWViMjA0MjE1ZGFmNEki%0ADXRyYWNraW5nBjsARnsISSIUSFRUUF9VU0VSX0FHRU5UBjsARiItNDRlNGE1%0AYTI1ZTlmYWRlODM1MmMyODg0MDM3NWJiZmJhZTE2OGE4ZkkiGUhUVFBfQUND%0ARVBUX0VOQ09ESU5HBjsARiItZWQyYjNjYTkwYTRlNzIzNDAyMzY3YTFkMTdj%0AOGIyODM5Mjg0MjM5OEkiGUhUVFBfQUNDRVBUX0xBTkdVQUdFBjsARiItY2M5%0AZjZmZWM2NTJhNDI1OGJjNmQyOTI4NzA1MjE3OWFiMWUwZDE0N0kiCmZsYXNo%0ABjsARnsASSIJY3NyZgY7AEYiRTBjNjI4ODdmNDM2YzRhNzJjM2Q3YWFjNzgw%0ANTc1OWQzZWNkNTQwOTVmNDhmNDU0ZTQ0YTAxMDkwM2RlNGQzN2RJIgh1aWQG%0AOwBGSSIaMTExOTY1Mjg4MDkzODI4NTA5Mjc1BjsAVA%3D%3D%0A--df8ffed7fb510b145d057b6c06a4f0c2d64c3917
11:36:41 web.1     | GATEWAY_INTERFACE: CGI/1.2
11:36:41 web.1     | SERVER_PORT: '6100'
11:36:41 web.1     | QUERY_STRING: ''
11:36:41 web.1     | SERVER_PROTOCOL: HTTP/1.1
11:36:41 web.1     | rack.url_scheme: http
11:36:41 web.1     | SCRIPT_NAME: ''
11:36:41 web.1     | REMOTE_ADDR: 127.0.0.1
11:36:41 web.1     | async.callback: !ruby/object:Method {}
11:36:41 web.1     | async.close: !ruby/object:EventMachine::DefaultDeferrable {}
11:36:41 web.1     | rack.logger: !ruby/object:Logger
11:36:41 web.1     |   progname: !!null 
11:36:41 web.1     |   level: 1
11:36:41 web.1     |   default_formatter: !ruby/object:Logger::Formatter
11:36:41 web.1     |     datetime_format: !!null 
11:36:41 web.1     |   formatter: !ruby/object:Logger::SimpleFormatter
11:36:41 web.1     |     datetime_format: !!null 
11:36:41 web.1     |   logdev: !ruby/object:Logger::LogDevice
11:36:41 web.1     |     shift_size: !!null 
11:36:41 web.1     |     shift_age: !!null 
11:36:41 web.1     |     filename: !!null 
11:36:41 web.1     |     dev: *2173887660
11:36:41 web.1     |     mutex: !ruby/object:Logger::LogDevice::LogDeviceMutex
11:36:41 web.1     |       mon_owner: !!null 
11:36:41 web.1     |       mon_count: 0
11:36:41 web.1     |       mon_mutex: !ruby/object:Mutex {}
11:36:41 web.1     | rack.session:
11:36:41 web.1     |   session_id: e48c4bcaa206c3e267323a67f1de8121fa41a50d56abe4c4b7deeb204215daf4
11:36:41 web.1     |   tracking: &2173863720
11:36:41 web.1     |     HTTP_USER_AGENT: 44e4a5a25e9fade8352c28840375bbfbae168a8f
11:36:42 web.1     |     HTTP_ACCEPT_ENCODING: ed2b3ca90a4e723402367a1d17c8b28392842398
11:36:42 web.1     |     HTTP_ACCEPT_LANGUAGE: cc9f6fec652a4258bc6d29287052179ab1e0d147
11:36:42 web.1     |   flash: &2173862960 {}
11:36:42 web.1     |   csrf: 0c62887f436c4a72c3d7aac7805759d3ecd54095f48f454e44a010903de4d37d
11:36:42 web.1     |   uid: '111111'
11:36:42 web.1     | rack.session.options:
11:36:42 web.1     |   :path: /
11:36:42 web.1     |   :domain: !!null 
11:36:42 web.1     |   :expire_after: !!null 
11:36:42 web.1     |   :secure: false
11:36:42 web.1     |   :httponly: true
11:36:42 web.1     |   :defer: false
11:36:42 web.1     |   :renew: false
11:36:42 web.1     |   :sidbits: 128
11:36:42 web.1     |   :secure_random: !ruby/object:Module
11:36:42 web.1     |     pid: 38462
11:36:42 web.1     |   :secret: wj-Sf/sdf_P49usi#sn132_sdnfij3
11:36:42 web.1     |   :coder: !ruby/object:Rack::Session::Cookie::Base64::Marshal {}
11:36:42 web.1     |   :id: e48c4bcaa206c3e267323a67f1de8121fa41a50d56abe4c4b7deeb204215daf4
11:36:42 web.1     | rack.request.cookie_hash:
11:36:42 web.1     |   rack.session: ! 'BAh7CkkiD3Nlc3Npb25faWQGOgZFRiJFZTQ4YzRiY2FhMjA2YzNlMjY3MzIz
11:36:42 web.1     | 
11:36:42 web.1     |     YTY3ZjFkZTgxMjFmYTQxYTUwZDU2YWJlNGM0YjdkZWViMjA0MjE1ZGFmNEki
11:36:42 web.1     | 
11:36:42 web.1     |     DXRyYWNraW5nBjsARnsISSIUSFRUUF9VU0VSX0FHRU5UBjsARiItNDRlNGE1
11:36:42 web.1     | 
11:36:42 web.1     |     YTI1ZTlmYWRlODM1MmMyODg0MDM3NWJiZmJhZTE2OGE4ZkkiGUhUVFBfQUND
11:36:42 web.1     | 
11:36:42 web.1     |     RVBUX0VOQ09ESU5HBjsARiItZWQyYjNjYTkwYTRlNzIzNDAyMzY3YTFkMTdj
11:36:42 web.1     | 
11:36:42 web.1     |     OGIyODM5Mjg0MjM5OEkiGUhUVFBfQUNDRVBUX0xBTkdVQUdFBjsARiItY2M5
11:36:42 web.1     | 
11:36:42 web.1     |     ZjZmZWM2NTJhNDI1OGJjNmQyOTI4NzA1MjE3OWFiMWUwZDE0N0kiCmZsYXNo
11:36:42 web.1     | 
11:36:42 web.1     |     BjsARnsASSIJY3NyZgY7AEYiRTBjNjI4ODdmNDM2YzRhNzJjM2Q3YWFjNzgw
11:36:42 web.1     | 
11:36:42 web.1     |     NTc1OWQzZWNkNTQwOTVmNDhmNDU0ZTQ0YTAxMDkwM2RlNGQzN2RJIgh1aWQG
11:36:42 web.1     | 
11:36:42 web.1     |     OwBGSSIaMTExOTY1Mjg4MDkzODI4NTA5Mjc1BjsAVA==
11:36:42 web.1     | 
11:36:42 web.1     |     --df8ffed7fb510b145d057b6c06a4f0c2d64c3917'
11:36:42 web.1     | rack.request.cookie_string: rack.session=BAh7CkkiD3Nlc3Npb25faWQGOgZFRiJFZTQ4YzRiY2FhMjA2YzNlMjY3MzIz%0AYTY3ZjFkZTgxMjFmYTQxYTUwZDU2YWJlNGM0YjdkZWViMjA0MjE1ZGFmNEki%0ADXRyYWNraW5nBjsARnsISSIUSFRUUF9VU0VSX0FHRU5UBjsARiItNDRlNGE1%0AYTI1ZTlmYWRlODM1MmMyODg0MDM3NWJiZmJhZTE2OGE4ZkkiGUhUVFBfQUND%0ARVBUX0VOQ09ESU5HBjsARiItZWQyYjNjYTkwYTRlNzIzNDAyMzY3YTFkMTdj%0AOGIyODM5Mjg0MjM5OEkiGUhUVFBfQUNDRVBUX0xBTkdVQUdFBjsARiItY2M5%0AZjZmZWM2NTJhNDI1OGJjNmQyOTI4NzA1MjE3OWFiMWUwZDE0N0kiCmZsYXNo%0ABjsARnsASSIJY3NyZgY7AEYiRTBjNjI4ODdmNDM2YzRhNzJjM2Q3YWFjNzgw%0ANTc1OWQzZWNkNTQwOTVmNDhmNDU0ZTQ0YTAxMDkwM2RlNGQzN2RJIgh1aWQG%0AOwBGSSIaMTExOTY1Mjg4MDkzODI4NTA5Mjc1BjsAVA%3D%3D%0A--df8ffed7fb510b145d057b6c06a4f0c2d64c3917
11:36:42 web.1     | rack.session.unpacked_cookie_data:
11:36:42 web.1     |   session_id: e48c4bcaa206c3e267323a67f1de8121fa41a50d56abe4c4b7deeb204215daf4
11:36:42 web.1     |   tracking: *2173863720
11:36:42 web.1     |   flash: *2173862960
11:36:42 web.1     |   csrf: 0c62887f436c4a72c3d7aac7805759d3ecd54095f48f454e44a010903de4d37d
11:36:42 web.1     |   uid: '111111'
11:36:42 web.1     | rack.request.query_string: ''
11:36:42 web.1     | rack.request.query_hash: {}
11:36:42 web.1     | 
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment