> > > > > The typical session stores a handful of utilitarian info: a user_id, a > > flash message, and perhaps a return URL. You shouldn't, and needn't, > > use the session for confidential data. > > > > I consider exposing these data (however obfuscated) as statement of > > the reasonable bounds of session usage.
Storing the user_id in a cookie is exactly the sort of security hole that does concern me. What steps have been taken to ensure that the data cannot be tampered? I also agree that rails should be secure by default. If the data is in text format, then I think session cookies by default is an unwise choice. Steven A Bristol --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "Ruby on Rails: Core" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/rubyonrails-core?hl=en -~----------~----~----~----~------~----~------~--~---
