Rust: crates.io security incident: improperly stored session cookies

[NewsBot]

A new Rust blog post/announcement has been posted!

Today the crates.io team discovered that the contents of the cargo_session cookie were being persisted to our error monitoring service, Sentry, as part of event payloads sent when an error occurs in the crates.io backend. The value of this cookie is a signed value that identifies the currently logged in user, and therefore these cookie values could be used to impersonate any logged in user.

Sentry access is limited to a trusted subset of the crates.io team, Rust infrastructure team, and the crates.io on-call rotation team, who already have access to the production environment of crates.io. There is no evidence that these values were ever accessed or used.

Nevertheless, out of an abundance of caution, we have taken these actions today:

1. We have merged and deployed a change to redact all cookie values from all Sentry events.
2. We hav...

Get the full details here: crates.io security incident: improperly stored session cookies | Rust Blog