Simplistic Cookie Session

simple_cookie_session.rb

require 'base64'
require 'json'
require 'securerandom'
require 'cgi'
require 'openssl'

SECRET_KEY = 'ea1b7350bf625a2caba95cc4dfb0045e5a45e0b1a5165e176b2ddf4b43282842a8e659d191d2c7ef802bdca8fdfaa21ea1de4f9ee8cfcd2e09200f88b6ec83e9'

sessions = {}

# Create a new session.
session = { session_id: SecureRandom.hex(32), user_id: 1337, current_ip: '38.104.6.162' }
# Add the new session to the global sessions hash.
sessions[session[:session_id]] = session

# Make a cookie.
session_data = Base64.encode64(session.to_json)
session_hash = OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha1'), SECRET_KEY, session_data)
cookie = CGI.escape("#{session_data}--#{session_hash}")

# Hypothetically we'd send the cookie here with a name. my_cookie=#{cookie}

# Read the cookie.
data, hash = CGI.unescape(cookie).split('--')

# Check and make sure the data wasn't changed.
if hash == OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha1'), SECRET_KEY, data)
  decoded_data = JSON.parse(Base64.decode64(data))
  puts decoded_data
else
  puts 'bad hash'
end

# What about a tampered cookie.
session = { session_id: SecureRandom.hex(32), user_id: 1, current_ip: '12.14.42.1' }
session_data = Base64.encode64(session.to_json)
# Notice we don't know how to make a new session_hash so maybe the hacker tries just not changing it.
cookie = CGI.escape("#{session_data}--#{session_hash}")

# Now we try again... Read the cookie.
data, hash = CGI.unescape(cookie).split('--')

# Check and make sure the data wasn't changed.
if hash == OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha1'), SECRET_KEY, data)
  decoded_data = JSON.parse(Base64.decode64(data))
  puts decoded_data
else
  puts 'bad hash'
end


# RUNNING THIS FILE
# > ruby ryan.rb 
# {"session_id"=>"06e1ce836b2052581c33baf730fe0c8a9cfc4d2f68af9e77ae005cd8030be45d", "user_id"=>1337, "current_ip"=>"38.104.6.162"}
# bad hash