Setting in_beta via cookies is insecure. about django-hunger

[joshuakarjala]

I think the problem with using the user settings - is that when a new user has been created - django starts a new session for this user - and here the invitation_code is lost - so I couldn't save which user had used which invitation code.

If we can find a way around this - then no problem.

[yesimon]

I'm not sure if my commit addresses your issue. My use case is that django-hunger is preventing new user registrations. Once a user is registered, then they can login freely.

I think the best fix would be attaching a signal to new user creations that would try to disable invitation_codes from there instead of trying to disable from a SIGNUP_CONFIRMATION_VIEW. For more generality, we can let users define a custom user model like django_social_auth does.

[yesimon]

I think perhaps the easiest way would be to remove the in_beta cookie and let them through in the middleware only if invitation_code matches a valid invitation_code in the database. This would not change the usage semantics and prevent invitations from being used more than once.

[joshuakarjala]

Ok I agree.

So basically like this.

The verify_invite view would just set the invitation_code cookie and no in_beta cookie.

Then in the middleware where now there is

in_beta = request.COOKIES.get('in_beta', False)

instead would be this function call

in_beta = validate_invitation_code()

And for deactivating the invitation_code - we would need to put a listener/receiver on the user_registered signal (from django-registration) - since this signal has the request object.
We can't use the normal User post_save - since this doesn't have a request. And I don't want to do the invitation_code matching on actual email address.

On 28/02/2012, at 05.40, Simon Ye wrote:

I think perhaps the easiest way would be to remove the in_beta cookie and let them through in the middleware only if invitation_code matches a valid invitation_code in the database. This would not change the usage semantics and prevent invitations from being used more than once.

---

Reply to this email directly or view it on GitHub:
#3 (comment)

[joshuakarjala]

I have implemented this in ff9a9a1

[joshuakarjala]

Let me know if you have any issues with this fix - or better solutions - otherwise I will close the ticket.