Skip to content

Add today's crates.io security notice about session cookies #1564

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Apr 11, 2025
Merged

Add today's crates.io security notice about session cookies #1564

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 37 additions & 0 deletions content/crates-io-security-session-cookies.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
+++
layout = "post"
date = 2025-04-11
title = "crates.io security incident: improperly stored session cookies"
author = "Adam Harvey"
team = "the crates.io team <https://www.rust-lang.org/governance/teams/crates-io>"
+++

Today the crates.io team discovered that the contents of the `cargo_session`
cookie were being persisted to our error monitoring service,
[Sentry](https://sentry.io/welcome/), as part of event payloads sent when an
error occurs in the crates.io backend. The value of this cookie is a signed
value that identifies the currently logged in user, and therefore these cookie
values could be used to impersonate any logged in user.

Sentry access is limited to a trusted subset of the crates.io team, Rust
infrastructure team, and the crates.io on-call rotation team, who already have
access to the production environment of crates.io. There is no evidence that
these values were ever accessed or used.

Nevertheless, out of an abundance of caution, we have taken these actions
today:

1. We have [merged and deployed a change to redact all cookie values from all
Sentry events](https://github.com/rust-lang/crates.io/pull/10991).
2. We have invalidated all logged in sessions, thus making the cookies stored
in Sentry useless. In effect, this means that every crates.io user has been
logged out of their browser session(s).

Note that API tokens are **not** affected by this: they are transmitted using
the `Authorization` HTTP header, and were already properly redacted before
events were stored in Sentry. All existing API tokens will continue to work.

We apologise for the inconvenience. If you have any further questions, please
contact us on
[Zulip](https://rust-lang.zulipchat.com/#narrow/stream/318791-t-crates-io) or
[GitHub](https://github.com/rust-lang/crates.io/discussions).