Q:

How to encrypt the session cookie in rails 4

Let us say I do something like this in my application:
session[user_id] = 1

According to the video I watched (referenced below): In rails 4: 

the session cookie by default is encoded but not encrypted.  Meaning:  The session cookie is not able to be altered because of the digest value.  If the savvy user alters the payload somehow then it will render the session cookie useless.
Regarding the fact that the session cookie is encoded, but not encrypted.  Even though the savvy user cannot successfully alter the session cookie, the savvy user is able to still read the contents.

I know that the convention is to never store anything confidential in a cookie: whether that cookie is a regular cookie or a session cookie.  However, for added security:  How can one encrypt the session cookie so that its contents are not able to be read by that savvy user at all?
Furthermore: How can I changed the default behavior of the session cookie from being just encoded by default to being encrypted as well?
Background:  I worked through the Lynda.com course "Ruby on Rails 4 Essential Training."  I got to the "Cookies and Sessions" video.
Also: relevant rails documentation.

A:

According to what I read here:

If you have secret_key_base set, your cookies will be encrypted. This goes a step further than signed cookies in that encrypted cookies cannot be altered or read by users. This is the default starting in Rails 4.

A:

After reviewing the relevant Rails Documentation, This area provides the answer:

If you only have secret_token set, your cookies will be signed, but not encrypted. This means a user cannot alter their user_id without knowing your app's secret key, but can easily read their user_id. This was the default for Rails 3 apps.
If you have secret_key_base set, your cookies will be encrypted. This goes a step further than signed cookies in that encrypted cookies cannot be altered or read by users. This is the default starting in Rails 4.

secret_key_base is located in rails 4 by default in: config/secrets.yml.  So actually: in rails 4 the default actually is to encrypt session cookies.

