Remove Activerecord session store

[zurbergram]

Description

GHSA-cvw2-xj8r-mjf7

Removing https://github.com/rails/activerecord-session_store as potential fix in that repo is taking a while to go out
And this is blocking #796

Original issue(s)

department-of-veterans-affairs/va.gov-team#0000

Testing done

• uploaded Weams.csv
• generated and published preview
• Spun up vets-api and vets-website
• http://localhost:3001/gi-bill-comparison-tool/
• searched for a school
• went to school's profile

Screenshots

Acceptance criteria

• [ ]

Definition of done

• Events are logged appropriately
• Documentation has been updated, if applicable
• A link has been provided to the originating GitHub issue (or connected to it via ZenHub)
• No sensitive information (i.e. PII/credentials/internal URLs/etc.) is captured in logging, hardcoded, or specs

[LindseySaari]

Can the temporary recommended fix be implemented instead?

[zurbergram]

Can the temporary recommended fix be implemented instead?

I tried that as well and received below after doing bundle clean --force and bundle install

Name: activerecord-session_store
Version: 1.1.3
Advisory: CVE-2019-25025
Criticality: Unknown
URL: https://github.com/advisories/GHSA-cvw2-xj8r-mjf7
Title: activerecord-session_store Timing Attack
Solution: remove or disable this gem until a patch is available!

Ok, just want to make sure theres no implications from crossing over to cookie store vs session store. Will this cause any hiccups with currently logged in users? After a fix is implemented, do you plan to switch back to session store? If this is a permanent switchover, you may consider removing the session table?

[zurbergram]

There are only a handful of users who use the gids dashboard and if an upload fails they will most likely attempt to re-upload the CSV file. After this change has been out there and no issues have come up we will clean up the database

[zurbergram]

Looks like #106 added the gem originally

[LindseySaari]

Ok sounds good. It looks like this post suggests some crossover solutions, but if only a handful of users will be logged out, it's not as high of a concern. You may want to send out a message to warn users though