Hacker News Reader

You are right. I think they should issue a new session id when you escalate. That way someone can't ride your session.

I checked, and it appears they don't regenerate the session id when escalating.

I am not an expert, but I think this is a case where you want to regenerate the session id.

We use Rails CookieStore. The cookie does change when you enter sudo mode, so a session would have to be compromised while you are in sudo mode.

Ah, you are correct. It changes in the tail position, and I was only looking at the first bit. Sorry about that.

It seems impossible to ride a session in this case, as the GP suggests.