<commit_before>---
layout: post
title: Rails Security - Sessions
category: posts
---

rails/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb

 > This cookie-based session store is the Rails default. Sessions typically
 > contain at most a user_id and flash message; both fit within the 4K cookie
 > size limit. Cookie-based sessions are dramatically faster than the
 > alternatives.

In regards to the digest at the end of the cookie...

 > A message digest is included with the cookie to ensure data integrity:
 > a user cannot alter his +user_id+ without knowing the secret key
 > included in the hash. New apps are generated with a pregenerated secret
 > in config/environment.rb. Set your own for old apps you're upgrading.


<commit_msg>title<commit_after>---
layout: post
title: 'Rails Security #1: Sessions'
category: posts
---

rails/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb

 > This cookie-based session store is the Rails default. Sessions typically
 > contain at most a user_id and flash message; both fit within the 4K cookie
 > size limit. Cookie-based sessions are dramatically faster than the
 > alternatives.

In regards to the digest at the end of the cookie...

 > A message digest is included with the cookie to ensure data integrity:
 > a user cannot alter his +user_id+ without knowing the secret key
 > included in the hash. New apps are generated with a pregenerated secret
 > in config/environment.rb. Set your own for old apps you're upgrading.



{'fraction_non_alphanumeric': 0.06274768824306473, 'fraction_numerical': 0.0019815059445178335, 'mean_word_length': 4.016556291390729, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 19, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1454864', 'n_tokens_mistral': 401, 'n_tokens_neox': 374, 'n_words': 203}