CODEWITHSUNDEEP
ruby-on-railsruby-on-rails-3sessioncookies
greenmoon55
greenmoon55

Reputation: 81

Rails: Where is message digest of sessions using default CookieStore

According to this question, session can be edited by user. But this answer suggests it's safe to store user id.

From Rails document

A message digest is included with the cookie to ensure data integrity: a user cannot alter his user_id without knowing the secret key included in the hash

With <%= debug(session) %> embedded in my page and the session value in Chrome's Developer tools, I can't find the message digest in the session cookie. If I login as user A and then login as user B, the session cookie remains the same excecpt user_id value.

So where is the message digest or do I need some configuration? The auto-generated secret_token exists in config/initializers/secret_token.rb. Is it stored in the server's memory and hash the session value on every request?

Upvotes: 1

Views: 180

Answers (1)

Frederick Cheung
Frederick Cheung

Reputation: 84132

The message digest is part of the cookie value. It's not part of the data you get in the session.

You can see it if you inspect the raw cookie value in chrome - the digest is separated from the payload by a '--'

Upvotes: 1

Related Questions