> Storing the user_id in a cookie is exactly the sort of security hole that > does concern me. What steps have been taken to ensure that the data cannot > be tampered?
That's what the HMAC is for, if you tamper with the data, the hash is no longer correct. http://en.wikipedia.org/wiki/Hmac > I also agree that rails should be secure by default. If the data is in text > format, then I think session cookies by default is an unwise choice. I don't believe there's a single person on this list who thinks we should ship security bugs. If there's a genuine problem with the cookie store, we'll take the actions needed to clean it up. > Steven A Bristol > > > > > -- Cheers Koz --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "Ruby on Rails: Core" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/rubyonrails-core?hl=en -~----------~----~----~----~------~----~------~--~---
