On 3/21/07, Steven A Bristol <[EMAIL PROTECTED]> wrote:
> > > The typical session stores a handful of utilitarian info: a user_id, a
> > > flash message, and perhaps a return URL. You shouldn't, and needn't,
> > > use the session for confidential data.
> > >
> > > I consider exposing these data (however obfuscated) as statement of
> > > the reasonable bounds of session usage.
>
> Storing the user_id in a cookie is exactly the sort of security hole that
> does concern me. What steps have been taken to ensure that the data cannot
> be tampered?
>
guid field instead of database IDs will mitigate some of your concerns
@user = User.find_by_guid(session[:user_id])
court3nay
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups "Ruby
on Rails: Core" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at
http://groups.google.com/group/rubyonrails-core?hl=en
-~----------~----~----~----~------~----~------~--~---
