Sinatra SSM
A Ruby session management library for Sinatra.
Background
SSM (Session Storage Management) is a Ruby library that handles cookie-based session storage in a Sinatra application.
Technologies and tools used
Core features
- Cookie-based sessions
- Session API
- CSRF protection
- Session rotation
- bcrypt
A session API usable in both the classic and modular Sinatra styles, with CSRF protection, session rotation and bcrypt for passwords.
Account hardening
- Lockout after failed attempts
- Password policy
- httponly & secure cookies
- Thread-safe storage
An account locks for fifteen minutes after five failed attempts, and passwords require twelve characters with an uppercase letter, a digit and a special character.
Challenges
- Mastering the HTTP cookie lifecycle and its client-side constraints.
- Securing sessions with bcrypt and an account lockout after repeated failures.
- Handling concurrency on shared storage, so two simultaneous requests do not conflict.
- Documenting the API so it is usable without reading the source.
Source code
github.com/HydroshieldMKII/Sinatra-SSM