Re: Re: Re: Are class variables session specific?

steve ross
2010-01-30T23:12:31Z

On Jan 30, 2010, at 3:06 PM, Ralph Shnelvar wrote:
>
>> I''m pretty sure that the only way to deal with values which
have to be
>> seen between requests is to either put them in some persistent storage
>> on the server (e.g. the DB, SQL or noSQL), or in the session and let
>> the browser give it back to you.
>
> So ... are "params" visible to 3rd parties if session management
is done
> via a cookie-based approach?
> If using ActionController::Base.session_store = :active_record_store a
> better way to do things?  If so ... why isn''t this the default?


This is kind of old news, but read here to see why your cookie-based sessions
are tamper resistant: http://www.rorsecurity.info/2007/11/20/rails-20-cookies/

With other session stores, you had to manually clean up periodically -- sweep up
the expired cookies. It''s waaaaaaaay easier this way.