On Mar 30, 2007, at 9:41 AM, Neil Wilson wrote:
AFAIR the session ID is stored in a cookie for all the other session stores. Doesn't much of what you say apply to the entire Rails session system?
No. The examples he gives are a specific consequence of using a cryptographic hash to sign the session, and storing it on an untrusted client. It has nothing to do with the fact that the sessions are stored in a cookie, and everything to do with the fact that without additional shared state, the only information the server has to go on is what is in the cookie.
smime.p7s
Description: S/MIME cryptographic signature
