Anonymous users in Rails - security concerns?

Question

I am looking at implementing some form of anonymous user system in Rails. I need people to do something (creating records, looking at what they created, etc.), without actually creating an account. Once they create an account, everything remains without the risk of losing it by clearing cookies or something like that.

Right now, I think it's pretty simple. Have the is_anonymous field in the User model and use something like this to access the currently logged in user:

def find_user session[:user_id] ||= create_new_anonymous_user.id end 

Assuming that the session is maintained for a reasonable period of time and the session cookie does not expire, this should ensure smooth operation.

However, there is this part of me that is convinced that I am missing something related to security. Has anyone done something like this before? Am I missing something super-obvious?

Thanks!

Answer 1

The only real security issue will be that these anonymous users can perform critical operations.

Your system means that anyone with a specific cookie will gain access to the site. Not necessarily a big deal, but it really depends on the type of information your users provide.

In the past, I did something similar (in my case, I tracked the progress of the work through the site, and when the user logged in or registered, I linked the “guest” data to their account. When you make this switch, make sure that you delete an anonymous record to prevent further access, and everything should be fine.

Answer 2

I just found a pretty cool example of “trial users” using Authlogic: http://github.com/gisikw/authlogic_trial

Answer 3

Assuming the session is saved for some reasonable period of time and the session cookie does not expire, which should keep everything operational smoothly.

You may need to set a separate long-lived cookie for a new user, so they can have multiple sessions (at least from this browser).

Answer 4

Are you sure you want people to create objects that are tied to accounts that may not exist? Unfortunately, I don’t know much about what your application actually does, but I think that a descent along this path may lead to you being left with orphans who do not really “belong” to any real users.

If you really want to do this, I think you have a decent one. You could create a real user marked as “guest” (or something else), and as soon as the user wants to really register, they will be asked to get other information and unflagged. You must add access control for non-guests, etc.