Rails 8 authentication: a restored backup reissues session IDs

Starting service worker…

Try it

While the page loaded, Carol signed in (session 1), and then a backup was taken (think: last night's backup). Nothing to do.
In Alice's browser, sign in as alice@example.test / 1234. She gets session 2 and sees her own note.
Click Restore backup. The database goes back to step 0. Alice's session is gone, and the highest session id is 1 again, so the next sign-in gets 2.
In Bob's browser, sign in as bob@example.test / 4321. He gets session 2, the number in Alice's cookie.
Click Reload in Alice's browser. Expected: she is signed out, because her session is gone.

The generated code stores the session's integer primary key in a signed cookie and looks it up with Session.find_by(id: cookies.signed[:session_id]). The signature proves the number came from this app. It does not prove that it is the same session row.

How this demo works

The generated authentication code is unchanged, in a small Rails 8.1 app (users, notes, and a page that shows who you are signed in as).
Everything runs in your browser: Ruby on WebAssembly (wasmify-rails) and SQLite (sqlite-wasm) in memory. A service worker handles the requests.
The three panels are emulated browsers. Each has its own cookie jar in the service worker; your browser's own cookies are not used. They share one client IP, so the generated sign-in rate limit (10 attempts in 3 minutes) is shared too.
Carol signs in automatically, through the normal sign-in form, before the backup.
The backup is a full snapshot of the SQLite database (sqlite3_serialize). Restore stops Rails, replaces the database with the snapshot (sqlite3_deserialize), and starts Rails again. There is no WAL here.
secret_key_base is random for this page and the same before and after the restore, as in production. Only Rails creates cookies, at sign-in; nothing here edits or forges them.
The result is shown only when Rails itself answers Alice's unchanged cookie with a different user after the last restore.
Reset demo (top right) starts over from step 0.

Alice's browser

Bob's browser

Carol's browser

Server

sessions.id	user_id	email	in backup

Server log