4 ms·
That's how _some_ session tracking works. See Rails' CookieStore strategy for session storage for example: http://guides.rubyonrails.org/security.html#session-s
by dgoodlad 14y ago
That's how _some_ session tracking works. See Rails' CookieStore strategy for session storage for example: http://guides.rubyonrails.org/security.html#session-storage http://guides.rubyonrails.org/security.html#session-storage
> Rails 2 introduced a new default session storage, CookieStore. CookieStore saves the session hash directly in a cookie on the client-side. The server retrieves the session hash from the cookie and eliminates the need for a session id. That will greatly increase the speed of the application, but it is a controversial storage option and you have to think about the security implications of it:
- chris_wot 14y agoThat's not how secure session management works.
- cheald 14y agoIt's plenty secure in the sense that you can't forge a session. It's not secure in the sense that the data is inaccessible if you know how to base64 decode a cookie. If you're using cookie sessions, you should know better than to store sensitive information in the session.
- chris_wot 14y agoIn other words, because they are holding sensitive information in their cookies encoded only via base64 it's not secure. In other words, what I said.